Loading story…
Apache InLong disclosed CVE-2026-63038, an important-severity SQL injection vulnerability caused by unsafe string concatenation in SQL command handling. The flaw affects Apache InLong versions 2.0.0 through before 2.4.0 and allows attackers to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.
The Apache project advised users to upgrade to Apache InLong 2.4.0 or cherry-pick the published fix to remediate the issue. The vulnerability was reported by Charles Zhang, and credit for identifying it was given to zhaokaifei.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On August 20, 2026, Charles Zhang published an oss-sec vulnerability report for CVE-2026-63038, an important-severity SQL injection issue in Apache InLong. The report credited zhaokaifei with finding the vulnerability.
Apache stated that SQL injection vulnerability CVE-2026-63038 affects Apache InLong versions 2.0.0 through before 2.4.0 and advised users to upgrade to version 2.4.0 or cherry-pick the referenced fix tied to issue 12135. The flaw stems from SQL string concatenation and allows arbitrary SQL injection via dbName, tableName, schemaName, and username parameters.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-62390**, an important-severity SQL injection vulnerability in Apache Kylin affecting versions **4 through 5.0.3**. The flaw is in a backend API used to refresh the table catalog cache, where improper neutralization of special elements can allow SQL injection in generated SQL statements. Apache said the issue is fixed in **Apache Kylin 5.0.4** and urged users to upgrade to that release. The vulnerability is tracked internally as **`KYLIN-6089`**, and credit for the discovery was given to **罗鑫**.
Jul 15, 2026
Apache Syncope disclosed **CVE-2026-57308**, an important SQL injection vulnerability in the Audit Events search functionality that can let an authenticated administrator with sufficient entitlements execute arbitrary SQL through stacked queries. The issue is caused by improper neutralization of special elements in SQL commands, specifically unsanitized `sort` parameters handled by the application. The vulnerability affects Apache Syncope versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.6`, and `4.1.0-M0` through `4.1.1`. Apache advised users to upgrade to **4.0.7** or **4.1.2** to remediate the flaw, and credited **Lennart Hostettler** with reporting the issue.
Jul 20, 2026
Apache disclosed **CVE-2026-35194**, a critical remote code execution flaw in Apache Flink that allows authenticated users with query submission privileges to run arbitrary code on **TaskManager** nodes. The vulnerability is caused by improper escaping of user-controlled input during Flink’s SQL code-generation process, where malicious SQL can be translated into attacker-controlled Java code. Apache said the issue affects Flink `1.15.0` through `1.20.x` before `1.20.4`, and `2.0.0` through `2.x` before `2.0.2`, `2.1.2`, and `2.2.1`. The flaw impacts JSON functions introduced in `1.15.0` and `LIKE` expressions with `ESCAPE` clauses introduced in `1.17.0`, creating a serious risk for multi-tenant and shared environments where non-administrative users may be able to escalate access, manipulate data, compromise clusters, and move laterally. Apache credited Yaswant Katakam of Confluent InfoSec for reporting the bug, while public disclosure also highlighted the danger of SQL-to-Java code translation paths in Flink’s engine. Organizations were urged to upgrade immediately to the patched releases.
Jun 29, 2026