Canonical version: https://thelooplet.com/posts/apache-inlong-vs-confluent-kafka-connect-which-survives-critical-vulnerabilities-better

Apache InLong vs Confluent Kafka Connect: Which Survives Critical Vulnerabilities Better

TL;DR: Apache InLong’s recent critical CVEs expose systemic auth and input‑validation flaws; teams should patch, isolate, and consider Kafka Connect’s tighter default hardening as a safer alternative for mission‑critical ingestion pipelines.

Introduction: A Security Shockwave Through InLong

The Apache InLong project announced three critical CVEs within days of each other—CVE‑2026‑63044 (SSRF), CVE‑2026‑63042 (improper authorization), and CVE‑2026‑63039 (SQL injection). All three affect core ingestion services and are exploitable remotely (Source: Currents). In a production environment where InLong is the backbone for streaming data from heterogeneous sources, a single unpatched endpoint can become a full‑blown data exfiltration vector.

What makes this cluster of bugs especially dangerous is the overlap of attack surfaces: the API layer, management endpoints, and the audit rule service all share the same underlying request‑dispatch framework. The result is a single breach that can pivot across services, bypassing network segmentation that many teams rely on. The thesis of this piece is simple: InLong’s current security posture is inferior to that of a mature alternative such as Confluent Kafka Connect, and the only way to close the gap is to adopt a disciplined patch‑and‑hardening workflow now.

CVE‑2026‑63044 – SSRF in /api/node/testConnection

CVE‑2026‑63044 targets the /api/node/testConnection endpoint, a diagnostic API that attempts to reach a user‑supplied host to verify connectivity. The endpoint fails to whitelist destinations, allowing an attacker to supply an internal IP or a cloud metadata service URL. The server then performs the outbound request on behalf of the attacker, leaking credentials or internal configuration.

The vulnerability is classified as critical because the attack requires no authentication and can be launched from any remote location (Source: Currents). In a typical Kubernetes deployment, the pod runs with network access to the cluster’s internal services, meaning a malicious payload can retrieve the Kubernetes service account token (/var/run/secrets/kubernetes.io/serviceaccount/token) via the metadata endpoint http://169.254.169.254/. Once the token is harvested, the attacker gains API‑level privileges across the entire cluster.

Mitigation steps are straightforward but often overlooked:

• Deploy a network‑policy that denies egress from the InLong pod to non‑whitelisted CIDR blocks.
• Patch the endpoint to enforce a strict allow‑list of hostnames (e.g., only *.example.com).
• Add request‑timeouts and limit the size of the response body to prevent data exfiltration.

A minimal code fix in Java looks like this:

@PostMapping("/api/node/testConnection")
public ResponseEntity<String> testConnection(@RequestParam String host) {
    List<String> whitelist = Arrays.asList("api.example.com", "ingest.example.com");
    if (!whitelist.contains(host)) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body("Host not allowed");
    }
    // Proceed with safe HttpClient call
    HttpResponse<String> resp = HttpClient.newHttpClient()
        .send(HttpRequest.newBuilder(URI.create("https://" + host)).build(),
              HttpResponse.BodyHandlers.ofString());
    return ResponseEntity.ok(resp.body());
}

The patch eliminates the SSRF vector by refusing any host outside the whitelist before any network call is made.

CVE‑2026‑63042 – Improper Authorization on Management Endpoints

CVE‑2026‑63042 exposes a flaw in the Management Endpoints component where role checks are either missing or incorrectly evaluated. An attacker who can reach the management API can invoke privileged actions—such as creating or deleting ingestion jobs—without possessing the required admin role (Source: Currents).

The root cause is a missing @PreAuthorize annotation on several controller methods. In practice, the bug manifests as a 200 OK response when a regular user POSTs to /management/job/create. Because the endpoint accepts JSON payloads that define the job topology, an attacker can spin up a malicious connector that forwards data to an external sink under their control.

Remediation requires two layers:

1. Code‑level fix – Add explicit role checks to each management method. Example in Spring Security:

   @PreAuthorize("hasAuthority('ADMIN')")
   @PostMapping("/management/job/create")
   public ResponseEntity<JobInfo> createJob(@RequestBody JobSpec spec) {
       // existing logic
   }

1. Operational hardening – Deploy an API‑gateway (e.g., Kong or Envoy) in front of the management port and enforce JWT‑based authentication with scopes that map to InLong roles. The gateway should also rate‑limit management calls to mitigate automated abuse.

Failure to apply both layers leaves the system vulnerable to privilege escalation, effectively turning any authenticated user into a super‑user.

CVE‑2026‑63039 – SQL Injection in AuditAlertRuleService

CVE‑2026‑63039 targets the AuditAlertRuleService component, which stores alert‑rule definitions in a relational backend. The service concatenates raw user input into an SQL statement without parameterisation, allowing an attacker to inject arbitrary SQL. The exploit can retrieve or delete rows from the audit_rules table, corrupting alert metadata and potentially disabling detection of further attacks (Source: Currents).

The vulnerability is critical because the service runs with DB credentials that have write access. A successful injection can drop tables, alter schema, or even execute privileged stored procedures. The attack surface is broadened by the fact that the audit rule UI accepts free‑form strings for rule conditions, which are directly passed to the backend.

Mitigation again has a dual nature:

• Parameterized queries – Replace string concatenation with prepared statements. In MyBatis, this looks like:

  <select id="listRules" parameterType="String" resultType="AuditRule">
      SELECT * FROM audit_rules WHERE condition LIKE #{condition}
  </select>

• Input sanitisation – Enforce a whitelist of allowed characters for rule expressions (e.g., alphanumerics, underscores, dots, and logical operators). Reject any payload containing semicolons, comment markers (--), or other SQL control characters.

Deploying an ORM that defaults to prepared statements (e.g., Hibernate) would have prevented this class of bug entirely.

Patch Management and Immediate Mitigation Workflow

All three CVEs were disclosed in July 2026 and were patched in the 1.9.2 release of Apache InLong (the first version to include the fixes). However, many enterprises still run 1.8.x due to legacy compatibility concerns. The following workflow reduces exposure while you plan a full upgrade:

1. Inventory – Use kubectl get pods -l app=inlong -o jsonpath='{.items[*].metadata.name}' to list every InLong pod. Cross‑reference the pod image tag with the release notes to confirm version.

2. Hot‑patch – If upgrading is not feasible, apply the code snippets above as a temporary patch via a side‑car init container that overwrites the vulnerable classes at startup.

3. Network Isolation – Apply a Kubernetes NetworkPolicy that restricts egress from InLong pods to only the whitelisted ingestion endpoints. Example:
   

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: inlong-egress-restrict
   spec:
     podSelector:
       matchLabels:
         app: inlong
     policyTypes:
       - Egress
     egress:
       - to:
           - ipBlock:
               cidr: 10.0.0.0/16
         ports:
           - protocol: TCP
             port: 443

1. Auth Hardening – Deploy an API gateway with JWT validation and enforce RBAC at the edge. Reject any request lacking the role=admin claim for management endpoints.

2. Database Guardrails – Enable MySQL’s sql_mode=STRICT_TRANS_TABLES,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION to reject malformed queries, and audit the audit_rules table for unexpected modifications.

Following this checklist buys you six to twelve weeks of protection while you schedule a full migration to the patched release.

Comparative Security Posture: InLong vs Confluent Kafka Connect

Confluent Kafka Connect (CKC) is often positioned as a “plug‑and‑play” ingestion framework. Its security model differs from InLong in three critical ways:

• Built‑in RBAC – CKC ships with a granular role‑based access control layer that is enabled by default in the enterprise distribution. InLong’s management endpoints require manual annotation of each controller, a step that many teams skip.
• Strict Schema Validation – CKC validates connector configurations against a JSON schema before persisting them. This prevents malformed inputs from reaching the connector runtime, eliminating a class of injection bugs that InLong suffers from.
• Limited Remote Execution – CKC’s REST API does not expose a generic “test connection” endpoint. Connectivity checks are performed client‑side, removing the SSRF surface entirely.

When measured against the three CVEs, CKC’s design inherently mitigates each attack vector:

Attack Vector	InLong (pre‑patch)	CKC (baseline)
SSRF via test endpoint	Yes (CVE‑63044)	No public endpoint for arbitrary host testing
Improper auth on management	Yes (CVE‑63042)	RBAC enforced, admin scope required
SQL injection in rule service	Yes (CVE‑63039)	Uses embedded Kafka topics for rule storage; no SQL layer

The trade‑off is operational: CKC relies on Confluent’s commercial licensing for the enterprise security features, whereas InLong is fully open source. Teams that cannot afford the license must either harden InLong themselves or accept the elevated risk.

What This Actually Means

The rapid succession of critical CVEs proves that InLong’s core architecture—centralised REST controllers with minimal input sanitisation—cannot be retrofitted with security after the fact without substantial engineering effort. My prediction is that, within the next 12 months, 40 % of large‑scale InLong deployments will either migrate to a hardened alternative (Kafka Connect, Pulsar IO) or adopt the Confluent Enterprise offering for its out‑of‑the‑box RBAC and schema enforcement.

Teams that cling to InLong version 1.8.x because of legacy connector compatibility are betting on a rapid internal patching process that historically has taken months in Apache projects. The real story is not the existence of the bugs—it is the systemic lack of defense‑in‑depth. Ignoring network‑policy isolation or relying on ad‑hoc code patches will create maintenance debt that will surface as new vulnerabilities faster than the community can respond.

Key Takeaways

• Patch to InLong 1.9.2 immediately; back‑port the whitelist check for /api/node/testConnection if you must stay on 1.8.x.
• Enforce Kubernetes NetworkPolicy to block all outbound traffic except to approved ingestion hosts.
• Deploy an API gateway with JWT‑based RBAC in front of management endpoints to close CVE‑63042.
• Replace string‑concatenated SQL in AuditAlertRuleService with prepared statements and strict input validation.
• Evaluate Confluent Kafka Connect’s built‑in security model; if licensing is a barrier, consider Pulsar IO as an open‑source alternative with comparable hardening.

Frequently Asked Questions

• How urgent is the upgrade to InLong 1.9.2?
  
  The three CVEs are classified as critical and are exploitable without authentication, so upgrading should be treated as a high‑priority emergency patch.

• Can I mitigate the SSRF issue without code changes?
  
  Yes. Applying a strict egress NetworkPolicy that blocks outbound traffic to internal IP ranges effectively neutralises the SSRF vector.

• Does Kafka Connect completely eliminate the risk of SQL injection?
  
  CKC stores connector configurations in Kafka topics, not a relational database, so the specific SQL‑injection class exploited in InLong does not exist in the default deployment.

• What is the recommended way to enforce RBAC on InLong management endpoints?
  
  Place an API gateway (Kong, Envoy) before the management port and configure JWT validation with scopes that map to InLong roles.

• Is there a community‑maintained patch for InLong 1.8.x?
  
  As of August 2026, no official back‑port exists; you must apply the code snippets manually or upgrade to the patched release.

See more articles on The Looplet

Further reading

Read Next

• Best Way to Harden Contactless Payments for Expired Card Abuse
• How to Fix Critical Linux Kernel CVE-2026-68278 CVE-2026-68284
• Best Way to Harden Cloud Gaming Streams Against Host OS Escape

Read next: continue with one of these related guides.

---

Originally published at The Looplet.