What’s Vulnerable › Vulnerabilities
CVE-2026-63046: Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-21 · updated 2026-10-16
- Weakness: CWE-88
Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it. [1] https://github.com/apache/inlong/pull/12151 . [2] https://github.com/apache/inlong/pull/12155 .
Affected products
- Apache Software Foundation Apache InLong: from 2.0.0 before 2.4.0 — fixed in 2.4.0
How to fix
Upgrade to a fixed version: Apache Software Foundation Apache InLong 2.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-63046 or the next vulnerability affects your stack