CVE-2026-40563
Code Injection in Apache Atlas
Publication date: 2026-05-04
Last updated on: 2026-05-06
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | atlas | From 0.8 (inc) to 2.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Control of Generation of Code, also known as a Code Injection vulnerability, found in Apache Atlas. The issue arises because Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. An attacker can manipulate the Gremlin traversal logic within the allowed grammar characters to access data that they are not intended to access.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to access unintended data by altering the query logic in Apache Atlas. This could lead to unauthorized data exposure, potentially compromising sensitive information. The impact is significant as indicated by the CVSS score of 7.1, with high confidentiality impact and low integrity impact.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are recommended to upgrade Apache Atlas to version 2.5.0, which fixes the issue.
Additionally, for affected versions 2.0 and above, ensure that the non-default configuration atlas.dsl.executor.traversal is not set to false, as the vulnerability only exists when this setting is false.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to alter query logic to access unintended data, which could lead to unauthorized data exposure.
Such unauthorized access to sensitive data may impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on data confidentiality and access.
However, the provided information does not explicitly describe the compliance implications or specific regulatory impacts.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the version of Apache Atlas running on your system and verifying the configuration setting related to the DSL executor traversal.
- Check the Apache Atlas version to see if it is between 0.8 and 2.4.0.
- For versions 2.0 and above, verify if the configuration 'atlas.dsl.executor.traversal' is set to false, which enables the vulnerability.
- Monitor or log requests to the DSL search endpoint for unusual or suspicious user-supplied query strings that could alter Gremlin traversal logic.
Example commands to detect the vulnerability might include:
- To check the Apache Atlas version: `atlas_version=$(atlas --version)` or check the version in the application logs or package manager.
- To check the configuration setting, search the Atlas configuration file (e.g., `atlas-application.properties`) for the line: `grep atlas.dsl.executor.traversal /path/to/atlas-application.properties`
- To monitor DSL search endpoint usage, use network monitoring tools or web server logs to look for suspicious query strings targeting the DSL search endpoint.