{"schema_version": "1.6.1", "id": "CVE-2026-63044", "summary": "Authenticated SSRF via POST /api/node/testConnection", "details": "Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 .", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "2.0.0"}, {"fixed": "2.4.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6"}]}