CVE-2023-51784 is a code injection flaw in Apache InLong that can lead to remote code execution. Versions 1.5.0 through 1.9.0 are affected. The record rates it Critical at 9.8, while Apache's announcement calls it important. Upgrade to 1.10.0 or apply the project's cherry-pick fix.
What's affected
Apache InLong 1.5.0 through 1.9.0. The project advises upgrading to 1.10.0, or cherry picking the change in pull request 9329.
The sources use different severity words. The record scores the flaw 9.8, which is Critical. The Apache announcement labels it important. Both describe remote code execution in the InLong Manager. Given the score and the vector, with no login required, we recommend treating it as urgent.
The record gives a CVSS score of 9.8 (Critical). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-94.
How to check if you're exposed
Find the version of the Apache InLong Manager that you deploy. It is in the release package name or container image tag you installed. Any version in the affected range needs action.
If you build on InLong libraries, check your dependency tree. For Maven projects, mvn dependency:tree and a search for inlong shows the version in use.
What to do now
- Identify every InLong Manager deployment and its version.
- Upgrade to 1.10.0 or later. If you cannot, apply the change from the project's pull request 9329.
- Do not expose the Manager to the internet. Restrict access to trusted internal networks.
- Review the Manager host for signs of unexpected processes or files, and rotate credentials the service can reach.
- Apply the same upgrade to test and staging copies, which are often forgotten.
Why it matters
The weakness is improper control of code generation, CWE-94, also called code injection. The application builds something that is then interpreted as code, and attacker supplied input gets mixed in. The result in the announcement is remote code execution on the Manager.
Remote code execution with no authentication and low complexity is as serious as scores get, which is why the record gives it 9.8. Apache's rating of important reflects its own scale, and it should not lower your urgency.
InLong moves data between systems, so the Manager often holds connection details for databases and message queues. Control of the Manager can mean access to everything it is wired to.
Try it yourself
See how a known fixed version is matched to your dependency so you can upgrade with confidence.
Click through it at your own pace, or open it full screen.
Quick check
Which versions are affected?
1.5.0 through 1.9.0, per the Apache announcement.
Is there a patch for older lines?
The project suggests either upgrading to 1.10.0 or cherry picking the change in pull request 9329.
Sources
Last reviewed: 19 October 2026.
