CVE-2026-40563: apache software foundation apache atlas Code Injection

Vulnerability summary

CVE-2026-40563 is a high (CVSS 8.1) Code Injection vulnerability in apache software foundation apache atlas. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.6% of scored vulnerabilities.

Timeline

1. 04-05-2026
   PublishedVulnerability first disclosed.
2. 06-05-2026
   Last modifiedVulnerability information updated.

Description

Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect Version: This issue affects Apache Atlas: from 0.8 through 2.4.0. For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration. atlas.dsl.executor.traversal=false Mitigation: Users are recommended to upgrade to version 2.5.0, which fixes the issue.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.