6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-27526

CVE-2025-27526: Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass

Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncode and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/11747

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-27526

CVE-2025-27526:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.inlong:manager-pojo	maven	>= 1.13.0, < 2.2.0	2.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-27526, concerns improper sanitization of JDBC connection strings in Apache InLong, specifically allowing bypasses through URL encoding and backspace characters. This could lead to the inclusion of dangerous parameters (e.g., autoDeserialize=true, allowLoadLocalInfile=true) in the JDBC URL, potentially resulting in deserialization of untrusted data or local file inclusion.

The core of the vulnerability resided in the org.apache.inlong.manager.pojo.util.MySQLSensitiveUrlUtils.filterSensitive method. Its previous implementation relied on a loop and a helper method containSensitiveKey to identify and remove parameters like key=true or key=yes. This approach was insufficient and could be bypassed. The patch (commit 48c2f5cad4a92be2c3561174d70cdbc91a2d2626) addresses this by removing the flawed containSensitiveKey method and overhauling the logic within filterSensitive, notably by introducing filterSensitiveKeyByBracket to more robustly parse and sanitize parameters, especially those within parentheses in the JDBC URL. It also ensures that certain sensitive parameters are explicitly set to safe defaults (e.g., autoDeserialize=false).

The method org.apache.inlong.manager.pojo.sink.mysql.MySQLSinkDTO.filterSensitive is a public static method that directly calls MySQLSensitiveUrlUtils.filterSensitive. As such, it acts as an accessible entry point for the vulnerable code. Any component using MySQLSinkDTO.filterSensitive to process user-supplied JDBC URLs would have been exposed to this vulnerability prior to the patch.

Therefore, during exploitation, these two functions would likely appear in a runtime profile: MySQLSinkDTO.filterSensitive as the initial call for URL processing, and MySQLSensitiveUrlUtils.filterSensitive (its pre-patch version) as the function containing the flawed sanitization logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.