CVE-2026-63038

CriticalCVSS 9.8

Published: 20/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

SQL Injection vulnerability in Apache InLong. An attacker can inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. Affects versions from 2.0.0 before 2.4.0.

Risk Assessment

The risk is the ability to execute arbitrary SQL code, potentially leading to full database compromise, including data read, modification, or deletion.

Recommendation

Upgrade Apache InLong to version 2.4.0 or apply the fix from the referenced issue (https://github.com/apache/inlong/issues/12135).

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/issues/12135 .