CVE-2023-31101
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
Apache InLong versions 1.5.0 through 1.6.0 have an insecure default initialization of resource vulnerability, allowing users who registered later to see deleted users' data. The issue concerns data visibility after account deletion.
Risk Assessment
This may lead to unauthorized disclosure of data belonging to deleted users, violating privacy and potentially causing information leakage. The risk affects organizations using Apache InLong 1.5.0–1.6.0.
Recommendation
Upgrade Apache InLong to version 1.7.0 or apply the relevant cherry-pick (PR #7836). Verify that deleted users' data is not accessible to new accounts.
Other vulnerabilities in Apache InLong
See all- CVE-2026-63039Critical
SQL Injection vulnerability in Apache InLong. An attacker can inject a string value into the SQL statement, enabling SQL injection. Affects versions from 2.0.0 before 2.4.0.
- CVE-2026-63038Critical
SQL Injection vulnerability in Apache InLong. An attacker can inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. Affects versions from 2.0.0 before 2.4.0.
- CVE-2026-63037Critical
SQL Injection vulnerability in Apache InLong. It allows SQL injection in the ORDER BY clause against the Manager backend database. Affects versions from 2.0.0 before 2.4.0.
- CVE-2023-35088Critical
CVE-2023-35088 describes an improper neutralization of special elements used in an SQL command vulnerability in Apache InLong, which may lead to SQL injection attacks. The issue affects versions from 1.4.0 through 1.7.0.
- CVE-2026-63046High
Argument injection vulnerability in Apache InLong. The Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. Affects versions from 2.0.0 before 2.4.0.
- CVE-2026-63044Medium
A Server-Side Request Forgery (SSRF) vulnerability in Apache InLong (from 2.0.0 before 2.4.0) allows any authenticated user (no admin role required) to cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports.
- CVE-2026-63043High
A Relative Path Traversal vulnerability in Apache InLong (from 2.0.0 before 2.4.0) allows arbitrary file read from the Agent host filesystem.
- CVE-2026-63042High
A vulnerability in Apache InLong (from 2.0.0 before 2.4.0) allows any user who can authenticate to the manager to create, modify, and delete Data Node definitions.
- CVE-2026-63040High
Vulnerability in Apache InLong allows access to files or directories by external parties. The StreamSource component performs no authorization check, so any authenticated user can logically delete ALL stream sources. Affects versions from 2.0.0 before 2.4.0.
- CVE-2026-63016Medium
The vulnerability in Apache InLong concerns uncontrolled resource consumption, which could allow users to affect operational configuration or upload non-official packages. The issue affects versions from 2.0.0 before 2.4.0.
Original NVD description (English source)
Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 to solve it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS