What is GHSA-3q63-2qmj-vfp6?

GHSA-3q63-2qmj-vfp6 is a security advisory published by GitHub Security Advisories with unknown severity. Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource...

Which CVE IDs does GHSA-3q63-2qmj-vfp6 cover?

GHSA-3q63-2qmj-vfp6 covers the following CVE IDs: CVE-2026-63040. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-3q63-2qmj-vfp6unknown

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource...

Vendor

GitHub Security Advisories

Published

August 20, 2026

Last Modified

August 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-63040 →

📋 Description

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12145 .

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-63040
https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offy
http://www.openwall.com/lists/oss-security/2026/08/20/14
https://github.com/advisories/GHSA-3q63-2qmj-vfp6