CVE-2026-40563: Apache Atlas Code Injection Vulnerability
Summary
CVE-2026-40563: Apache Atlas has a Code Injection Vulnerability. Affects org.apache.atlas:apache-atlas versions >= 0.8, < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Atlas is an open-source project that provides a scalable and extensible set of core foundational governance services to enable enterprises to effectively and efficiently meet their compliance requirements. It offers capabilities for data classification, data lineage, and metadata management. However, it has a vulnerability that allows attackers to manipulate query strings, potentially leading to unauthorized data access.
Vulnerability Detail
The vulnerability in Apache Atlas arises from improper control of the generation of code, specifically a Code Injection issue. The DSL search endpoint of Apache Atlas accepts user-supplied query strings, which can be exploited by attackers. By altering the Gremlin traversal logic within allowed characters, an attacker can access unintended data. This vulnerability affects versions from 0.8-incubating through 2.4.0, and for versions 2.0.0 and above, it is only exploitable when a specific non-default configuration is set.
How To Fix
Latest published version: 2.5.0 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can set the following configuration to mitigate the risk of exploitation:
atlas.dsl.executor.traversal=false
This setting should be applied in the configuration files of Apache Atlas until an upgrade can be performed.
Conclusion
The Apache Atlas Code Injection Vulnerability (CVE-2026-40563) poses a significant risk to data security by allowing unauthorized access to sensitive information. Users are strongly advised to upgrade to version 2.5.0 or apply the recommended workaround to mitigate the risk until an upgrade can be performed.
See every vulnerability recorded for org.apache.atlas:apache-atlas →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
The vulnerability affects Apache Atlas versions from 0.8-incubating through 2.4.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate upgrade is not possible, apply the workaround by setting atlas.dsl.executor.traversal=false in your configuration.
The code injection vulnerability allows attackers to manipulate query strings to access unintended data through the DSL search endpoint.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.atlas:apache-atlas.
