Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-63039 EUVD-2026-63400GHSA-pg4r-4hvf-4rqh

Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

Published Aug 20, 2026 · Updated Aug 24, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache InLong

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into
the SQL statement, enabling SQL injection.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12080 .

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache InLong 2.0.0 – < 2.4.0 2.4.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • oscerd/CVE-2026-63039 ★ 0 · Aug 24, 2026

    Reproducer for CVE-2026-63039 (Apache InLong AuditAlertRule MyBatis ORDER BY SQL injection via orderField/orderType)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References