CVE-2026-64959None▾ SunlitImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public netwo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 5.0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63618NoneApache Kylin: Low-Privilege Config Exposure
CVE-2026-63619NoneApache Kylin: Missing authorization and path-confinement on system meta dump
CVE-2026-68571NoneApache Kylin: JDBC URL Whitelist Verification Bypass
CVE-2026-64610NoneApache Kylin: Redis unsafe Java deserialization
CVE-2026-96806NoneApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
CVE-2026-94134NoneApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default