CVE-2026-68571None▾ SunlitImproper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is n…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4.0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63618NoneApache Kylin: Low-Privilege Config Exposure
CVE-2026-63619NoneApache Kylin: Missing authorization and path-confinement on system meta dump
CVE-2026-64610NoneApache Kylin: Redis unsafe Java deserialization
CVE-2026-64959NoneApache Kylin: Missing authentication on certain cache API endpoints
CVE-2026-96806NoneApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
CVE-2026-94134NoneApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default