CVE-2023-51785 is a deserialization of untrusted data flaw in Apache InLong that allows arbitrary file reads through the MySQL driver. Versions 1.7.0 through 1.9.0 are affected. The record rates it High at 7.5. Upgrade to 1.10.0 or apply the project's cherry-pick fix.
What's affected
Apache InLong 1.7.0 through 1.9.0. The project advises upgrading to 1.10.0, or cherry picking the change in pull request 9331.
Apache's announcement calls the issue important, and the record scores it 7.5, which is High. These are two ways of describing one issue.
The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity none, and on availability none. The weakness class is CWE-502.
How to check if you're exposed
Find the version of the Apache InLong Manager that you deploy. It is in the release package name or container image tag you installed. Any version in the affected range needs action.
If you build on InLong libraries, check your dependency tree. For Maven projects, mvn dependency:tree and a search for inlong shows the version in use.
This CVE affects a narrower range than CVE-2023-51784, which starts at 1.5.0. A deployment on 1.5.x or 1.6.x is outside this range but inside the other, so upgrading to 1.10.0 is the clean answer for both.
What to do now
- Identify InLong Manager deployments and versions.
- Upgrade to 1.10.0 or later, or apply the change from pull request 9331.
- Keep the Manager off the internet and limit network access to it.
- Review what files the Manager's service account can read, and move secrets out of readable locations where you can.
- Rotate credentials stored on the host if exposure cannot be ruled out.
Why it matters
The weakness is deserialization of untrusted data, CWE-502. Per the announcement, an attacker can use the MySQL driver to read arbitrary files. The Manager accepts connection settings, and a crafted setting can make the driver behave in ways its designers did not intend.
The impact is on confidentiality only, according to the vector. That sounds modest, but files on a data pipeline host can include keys, tokens and configuration for other systems. A read only bug is often the first step in a longer attack.
It was published on the same day as CVE-2023-51784 and shares the same fixed release, so one upgrade closes both.
Quick check
What is the fixed version?
1.10.0, according to the Apache announcement.
How does it differ from CVE-2023-51784?
This one allows file reads and affects 1.7.0 through 1.9.0. The other allows code execution and affects 1.5.0 through 1.9.0.
Sources
Last reviewed: 19 October 2026.
