Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/05/03/9 | Mailing List Third Party Advisory |
Configurations
History
06 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
05 May 2026, 20:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/05/03/9 - Mailing List, Third Party Advisory | |
| First Time |
Apache
Apache atlas |
|
| CPE | cpe:2.3:a:apache:atlas:*:*:*:*:*:*:*:* |
04 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
04 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-04 16:16
Updated : 2026-05-06 14:16
NVD link : CVE-2026-40563
Mitre link : CVE-2026-40563
CVE.ORG link : CVE-2026-40563
JSON object : View
Products Affected
apache
- atlas
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')