CVE-2026-63040

highpriority · track · 0EPSS 0.006 · 51 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.64% (51st) EPSS

CVSS 8.1 · high

Is it mine?

1 products

Check your exposure

Who says so?

1 sources

nvd

EPSS · scored 2026-10-27

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12145 .

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hsecondaryexploitability 2.8 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-552US

affected products (1)

Products and version ranges known to be affected.

apache inlong2.0.0 → 2.4.0nvdUScpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

sources

Which sources assert this record, and when.

nvd NVD CVE.org MITRE

published 2026-08-20modified 2026-10-18

references (2) nvd

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/08/20/14Mailing ListThird Party Advisory
https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offyMailing ListVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan