CVE-2026-63046 PUBLISHED

Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials

Assigner: apache
Reserved: 15.07.2026 Published: 21.08.2026 Updated: 21.08.2026

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.

[1]  https://github.com/apache/inlong/pull/12151 .

[2]  https://github.com/apache/inlong/pull/12155 .

Product Status

Vendor Apache Software Foundation
Product Apache InLong
Versions Default: unaffected
  • affected from 2.0.0 to 2.4.0 (excl.)

Credits

  • IcySun finder

References

Problem Types

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE