apache_kylin vulnerabilities
CVEs whose affected-version data names the apache_kylin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-63618High· 7.5Apache Kylin: Low-Privilege Config Exposure
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, w…
CVE-2026-68571NoneApache Kylin: JDBC URL Whitelist Verification Bypass
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is n…
CVE-2026-63619NoneApache Kylin: Missing authorization and path-confinement on system meta dump
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common…
CVE-2026-64959NoneApache Kylin: Missing authentication on certain cache API endpoints
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public netwo…
CVE-2026-64610NoneApache Kylin: Redis unsafe Java deserialization
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade…