Gremlin Injection Flaw in Apache Atlas Exposes Enterprise Data

Apache Atlas suffers a code-injection vulnerability (CVE-2026-40563) in its DSL search endpoint that can be manipulated to alter Gremlin traversal logic and exfiltrate unintended data. The flaw affects versions 0.8 through 2.4.0; for versions >=2.0 exploitation requires a non-default configuration (atlas.dsl.executor.traversal=false). Apache has released a fix and administrators are advised to upgrade to 2.5.0 to eliminate the injection vector.