open-source-dependency-vulnerabilityinternet-facing-service-vulnerability

Apache InLong SQL Injection Flaw Allows Arbitrary SQL via Multiple Parameters

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 20, 2026

Apache InLong disclosed CVE-2026-63038, an important-severity SQL injection vulnerability caused by unsafe string concatenation in SQL command handling. The flaw affects Apache InLong versions 2.0.0 through before 2.4.0 and allows attackers to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.

The Apache project advised users to upgrade to Apache InLong 2.4.0 or cherry-pick the published fix to remediate the issue. The vulnerability was reported by Charles Zhang, and credit for identifying it was given to zhaokaifei.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Aug 20, 2026

Reported Aug 20, 20263mo ago
Apache InLong fixes CVE-2026-63038 in version 2.4.0
Apache stated that SQL injection vulnerability CVE-2026-63038 affects Apache InLong versions 2.0.0 through before 2.4.0 and advised users to upgrade to version 2.4.0 or cherry-pick the referenced fix tied to issue 12135. The flaw stems from SQL string concatenation and allows arbitrary SQL injection via dbName, tableName, schemaName, and username parameters.
oss-sec: CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability Report
Aug 20, 20263mo ago
Apache discloses CVE-2026-63038 on oss-sec
On August 20, 2026, Charles Zhang published an oss-sec vulnerability report for CVE-2026-63038, an important-severity SQL injection issue in Apache InLong. The report credited zhaokaifei with finding the vulnerability.
oss-sec: CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability Report

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

SQL Injection in Apache InLong (CVE-2026-63038)

Affected products

1 linked

Apache Inlong

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Oss Security Mailing ListNews · Aug 20, 2026

oss-sec: CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability ReportOpen source ↗

UnclassifiedNews · Jan 1, 2024

Apache InLong | Apache InLongOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

open-source-dependency-vulnerabilityinternet-facing-service-vulnerability

Apache InLong SQL Injection Flaw Allows Arbitrary SQL via Multiple Parameters

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 20, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Aug 20, 2026

Reported Aug 20, 20263mo ago
Apache InLong fixes CVE-2026-63038 in version 2.4.0
Apache stated that SQL injection vulnerability CVE-2026-63038 affects Apache InLong versions 2.0.0 through before 2.4.0 and advised users to upgrade to version 2.4.0 or cherry-pick the referenced fix tied to issue 12135. The flaw stems from SQL string concatenation and allows arbitrary SQL injection via dbName, tableName, schemaName, and username parameters.
oss-sec: CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability Report
Aug 20, 20263mo ago
Apache discloses CVE-2026-63038 on oss-sec
On August 20, 2026, Charles Zhang published an oss-sec vulnerability report for CVE-2026-63038, an important-severity SQL injection issue in Apache InLong. The report credited zhaokaifei with finding the vulnerability.
oss-sec: CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability Report

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

SQL Injection in Apache InLong (CVE-2026-63038)

Affected products

1 linked

Apache Inlong

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Oss Security Mailing ListNews · Aug 20, 2026

oss-sec: CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability ReportOpen source ↗

UnclassifiedNews · Jan 1, 2024

Apache InLong | Apache InLongOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Apache InLong SQL Injection Flaw Allows Arbitrary SQL via Multiple Parameters

How this story unfolded

Apache InLong fixes CVE-2026-63038 in version 2.4.0

Apache discloses CVE-2026-63038 on oss-sec

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Kylin SQL Injection Flaw in Catalog Cache Refresh API

Apache Syncope Audit Events Search Flaw Enables SQL Injection

Critical Apache Flink RCE Lets Authenticated Users Execute Code via SQL Injection

Apache InLong SQL Injection Flaw Allows Arbitrary SQL via Multiple Parameters

How this story unfolded

Apache InLong fixes CVE-2026-63038 in version 2.4.0

Apache discloses CVE-2026-63038 on oss-sec

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Kylin SQL Injection Flaw in Catalog Cache Refresh API

Apache Syncope Audit Events Search Flaw Enables SQL Injection

Critical Apache Flink RCE Lets Authenticated Users Execute Code via SQL Injection