CVE-2026-63038

Published Aug 20, 2026

Last updated 4 days ago

Overview

Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.  This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/issues/12135 .
Source
security@apache.org
NVD status
Received

Weaknesses

security@apache.org
CWE-89

Social media

Hype score
Not currently trending

  1. An Apache InLong SQL injection flaw, CVE-2026-63038, lets attackers inject SQL via multiple parameters. Two more bugs join it. Upgrade to 2.4.0. #ApacheInLong #SQLInjection #CVE #SSRF #InfoSec #OpenSource https://t.co/KSAJeNpUlb

    @Daily_CyberSec

    20 Aug 2026

    353 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

References

Sources include official advisories and independent security research.