Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. (CVE-2026-63044)
Apache InLong versions from 2.0.0 up to but not including 2.4.0 contain a Server-Side Request Forgery (SSRF) vulnerability. Any authenticated user, without requiring admin privileges, can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This vulnerability is identified as CVE-2026-63044 and has a CVSS 3.1 base score of 5.4, indicating medium severity. Users are advised to upgrade to version 2.4.0 or apply the relevant patch to remediate the issue.
AI Analysis
Technical Summary
CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong affecting versions >=2.0.0 and <2.4.0. The flaw allows any authenticated user, without needing admin rights, to induce the InLong Manager server to initiate outbound HTTP or TCP connections to arbitrary internal network hosts and ports. This could potentially be leveraged to access internal resources not otherwise accessible to the user. The vulnerability is tracked under CWE-918. The issue is fixed in Apache InLong 2.4.0, and users are recommended to upgrade or cherry-pick the patch from the referenced GitHub pull request.
Potential Impact
The vulnerability allows an authenticated user with any role to cause the server to make outbound requests to arbitrary internal hosts and ports. This could lead to unauthorized internal network scanning or access to internal services that are otherwise protected. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score of 5.4 reflects a moderate risk due to the requirement for authentication and the limited scope of impact.
Mitigation Recommendations
A fix is available in Apache InLong version 2.4.0. Users should upgrade to this version or apply the patch referenced in the GitHub pull request https://github.com/apache/inlong/pull/12130 to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. (CVE-2026-63044)
Description
Apache InLong versions from 2.0.0 up to but not including 2.4.0 contain a Server-Side Request Forgery (SSRF) vulnerability. Any authenticated user, without requiring admin privileges, can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This vulnerability is identified as CVE-2026-63044 and has a CVSS 3.1 base score of 5.4, indicating medium severity. Users are advised to upgrade to version 2.4.0 or apply the relevant patch to remediate the issue.
CVSS v3.1
Score 5.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong affecting versions >=2.0.0 and <2.4.0. The flaw allows any authenticated user, without needing admin rights, to induce the InLong Manager server to initiate outbound HTTP or TCP connections to arbitrary internal network hosts and ports. This could potentially be leveraged to access internal resources not otherwise accessible to the user. The vulnerability is tracked under CWE-918. The issue is fixed in Apache InLong 2.4.0, and users are recommended to upgrade or cherry-pick the patch from the referenced GitHub pull request.
Potential Impact
The vulnerability allows an authenticated user with any role to cause the server to make outbound requests to arbitrary internal hosts and ports. This could lead to unauthorized internal network scanning or access to internal services that are otherwise protected. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score of 5.4 reflects a moderate risk due to the requirement for authentication and the limited scope of impact.
Mitigation Recommendations
A fix is available in Apache InLong version 2.4.0. Users should upgrade to this version or apply the patch referenced in the GitHub pull request https://github.com/apache/inlong/pull/12130 to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qvfh-v498-xrrf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63044"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a89a6dfacd9273b49151ee4
Added to database: 08/22/2026, 13:40:47 UTC
Last enriched: 08/22/2026, 14:07:13 UTC
Last updated: 08/22/2026, 15:51:58 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.