CVE-2026-40563 - Vulnerability Analysis

Overview

Apache Atlas 0.8 through 2.4.0 contains a code injection caused by improper control of user-supplied query strings in the DSL search endpoint, letting attackers alter Gremlin traversal logic to access unintended data, exploit requires non-default configuration atlas.dsl.executor.traversal=false for versions >= 2.0.

Severity & Score

Impact

Attackers can manipulate query logic to access unauthorized data, potentially leading to sensitive information disclosure.

Mitigation

Upgrade to version 2.5.0.

References

• http://www.openwall.com/lists/oss-security/2026/05/03/9
• https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner