CVE-2026-40563

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40563", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-04-14T12:05:23.666Z", "datePublished": "2026-05-04T15:17:32.511Z", "dateUpdated": "2026-05-06T13:27:03.304Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.atlas:atlas-repository", "product": "Apache Atlas", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.4.0", "status": "affected", "version": "0.8", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Khaled M. Alshammri"}, {"lang": "en", "type": "finder", "value": "qx L"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><b>Description:</b><br>Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas<br>Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data<br></p><p></p><p><b>Affect Version:</b><br>This issue affects Apache Atlas: from 0.8 through 2.4.0.</p><p></p><p>For the affect version &gt;= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.<br></p><div><pre>atlas.dsl.executor.traversal=false</pre></div><b>Mitigation:</b><br>Users are recommended to upgrade to version 2.5.0, which fixes the issue.<p></p>"}], "value": "Description:\nImproper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas\nApache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data\n\n\n\n\nAffect Version:\nThis issue affects Apache Atlas: from 0.8 through 2.4.0.\n\n\n\nFor the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.\n\n\natlas.dsl.executor.traversal=false\n\n\n\nMitigation:\nUsers are recommended to upgrade to version 2.5.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-05-04T15:17:32.511Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Atlas: Script injection allows access to unintended data", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/03/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-04T15:43:57.213Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T03:56:07.820266Z", "id": "CVE-2026-40563", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:27:03.304Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/03/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-04T15:43:57.213Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-40563", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T03:56:07.820266Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T16:03:10.689Z"}}], "cna": {"title": "Apache Atlas: Script injection allows access to unintended data", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Khaled M. Alshammri"}, {"lang": "en", "type": "finder", "value": "qx L"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Atlas", "versions": [{"status": "affected", "version": "0.8", "versionType": "semver", "lessThanOrEqual": "2.4.0"}], "packageName": "org.apache.atlas:atlas-repository", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Description:\nImproper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas\nApache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data\n\n\n\n\nAffect Version:\nThis issue affects Apache Atlas: from 0.8 through 2.4.0.\n\n\n\nFor the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.\n\n\natlas.dsl.executor.traversal=false\n\n\n\nMitigation:\nUsers are recommended to upgrade to version 2.5.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p><b>Description:</b><br>Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas<br>Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data<br></p><p></p><p><b>Affect Version:</b><br>This issue affects Apache Atlas: from 0.8 through 2.4.0.</p><p></p><p>For the affect version &gt;= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.<br></p><div><pre>atlas.dsl.executor.traversal=false</pre></div><b>Mitigation:</b><br>Users are recommended to upgrade to version 2.5.0, which fixes the issue.<p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-05-04T15:17:32.511Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40563", "state": "PUBLISHED", "dateUpdated": "2026-05-06T13:27:03.304Z", "dateReserved": "2026-04-14T12:05:23.666Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-05-04T15:17:32.511Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.atlas:atlas-repository", "product": "Apache Atlas", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.4.0", "status": "affected", "version": "0.8", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:atlas:*:*:*:*:*:*:*:*", "matchCriteriaId": "60FA8FF5-6183-4E24-AD44-3D6D2E0FC66C", "versionEndExcluding": "2.5.0", "versionStartIncluding": "0.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Description:\nImproper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas\nApache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data\n\n\n\n\nAffect Version:\nThis issue affects Apache Atlas: from 0.8 through 2.4.0.\n\n\n\nFor the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.\n\n\natlas.dsl.executor.traversal=false\n\n\n\nMitigation:\nUsers are recommended to upgrade to version 2.5.0, which fixes the issue."}, {"lang": "es", "value": "Descripci\u00f3n:\nVulnerabilidad de control inadecuado de la generaci\u00f3n de c\u00f3digo (\u2019Inyecci\u00f3n de c\u00f3digo\u2019) en Apache Atlas\nApache Atlas expone un endpoint de b\u00fasqueda DSL que acepta cadenas de consulta proporcionadas por el usuario. El atacante puede alterar la l\u00f3gica de recorrido de Gremlin dentro de los caracteres permitidos por la gram\u00e1tica para acceder a datos no deseados. Versi\u00f3n afectada:\nEste problema afecta a Apache Atlas: desde la versi\u00f3n 0.8 hasta la 2.4.0. Para la versi\u00f3n afectada mayor o igual que 2.0, la vulnerabilidad solo existe cuando Atlas se despliega con la siguiente configuraci\u00f3n no predeterminada. atlas.dsl.executor.traversal=false Mitigaci\u00f3n:\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.5.0, que corrige el problema."}], "id": "CVE-2026-40563", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40563", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T03:56:07.820266Z", "version": "2.0.3"}}]}, "published": "2026-05-04T16:16:02.283", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/05/03/9"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.8,2.4.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Atlas", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "atlas", "vendor": "apache"}], "created": "2026-05-04T17:30:04.687689+00:00", "updated": "2026-05-06T16:30:06.720214+00:00", "vendors": ["apache", "apache$PRODUCT$atlas"]}