CVE-2026-40563
HighSummary
Apache Atlas has a code injection vulnerability that allows an attacker to alter Gremlin traversal logic by supplying malicious query strings. This can lead to unauthorized access to data.
Risk Assessment
Organizations may be exposed to the disclosure of sensitive data, potentially resulting in serious legal and reputational consequences.
Recommendation
It is recommended to upgrade to version 2.5.0, which addresses this vulnerability.
Other vulnerabilities in Apache Atlas
See all- CVE-2017-3154High
Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
- CVE-2016-8752High
Apache Atlas versions 0.6.0, 0.7.0, and 0.7.1 allow access to the webapp directory contents by pointing to URIs like /js and /img.
- CVE-2026-50622High
In Apache Atlas, missing authorization in admin endpoints allows any authenticated user, regardless of role, to perform administrative operations.
- CVE-2025-62198Medium
An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier.
Original NVD description (English source)
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect Version: This issue affects Apache Atlas: from 0.8 through 2.4.0. For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration. atlas.dsl.executor.traversal=false Mitigation: Users are recommended to upgrade to version 2.5.0, which fixes the issue.