CVE-2026-40563 Apache Atlas: Script injection allows access to unintended data
Attackers can inject code into Apache Atlas DSL search endpoints to access unintended data, requiring specific non-default configurations in newer versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40563?
CVE-2026-40563 is a high-severity code injection vulnerability in Apache Atlas, published on 4 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version: This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation: Users are recommended to upgrade to version 2.5.0, which fixes the issue.
Weakness: CWE-94
Which versions are affected by CVE-2026-40563?
2 open source packages ship an affected version, including org.apache.atlas:apache-atlas. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.atlas:apache-atlas Maven | From 0.8 | 2.5.0 |
org.apache.atlas:apache-atlas Maven | From 0.8 | 2.5.0 |
Products include Apache Atlas.
How do I fix CVE-2026-40563?
Upgrade org.apache.atlas:apache-atlas to 2.5.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-40563 being exploited?
There is no known exploitation of CVE-2026-40563 in the wild and no public exploit code.
Other vulnerabilities in Apache Atlas
- CVE-2026-50622 Apache Atlas: Missing Authorization on Admin Endpoints
- CVE-2022-34271 Apache Atlas: zip path traversal in import functionality
- CVE-2016-8752 Path Traversal in Apache Atlas
- CVE-2017-3154 Apache Atlas produces Stack trace in error response
- CVE-2024-46910 Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user
Sources
Also known as CLEANSTART-2026-KR00800, GHSA-35xx-9xrg-gwhf.