apache_kylin vulnerabilities
CVEs whose affected-version data names the apache_kylin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
21 CVEsRSS
CVE-2026-108776NoneApache Kylin: tables/names SparkSQL injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue a…
CVE-2026-108780NoneApache Kylin: Potential JDBC source configuration validation issue
Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are r…
CVE-2026-108766NoneApache Kylin: missing JDBC-config authorization
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue aff…
CVE-2026-108823NoneApache Kylin: Potential unauthenticated job metadata replacement
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 …
CVE-2026-108771NoneApache Kylin: unauthenticated broadcast API and polymorphic deserialization
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments a…
CVE-2026-108837NoneApache Kylin: Potential computed-column resource exhaustion
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Ky…
CVE-2026-108833NoneApache Kylin: default startup profile miss security settings
Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to v…
CVE-2026-108764NoneApache Kylin: job-driver UI proxy SSRF
Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue af…
CVE-2026-108762NoneApache Kylin: delete metadata backup path-confinement bypass
Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issu…
CVE-2026-108743High· 8.8Apache Kylin: spark job OS command injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin …
CVE-2026-108709Critical· 9.8Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects …
CVE-2026-69080High· 7.5Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2026-69076High· 7.5Apache Kylin: Unauthorized cross-project job discard
Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. Th…
CVE-2026-68572High· 7.5Apache Kylin: Unauthorized SQL execution to Spark SQL env
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2026-68573Critical· 9.8Apache Kylin: Unauthenticated Metastore Cleanup
Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployme…
CVE-2026-69077High· 7.5Apache Kylin: JobController allows unauthorized cross-project manipulation
Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted…
CVE-2026-63618High· 7.5Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, w…
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, w…
CVE-2026-68571High· 8.8Apache Kylin: JDBC URL Whitelist Verification Bypass
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is n…
CVE-2026-63619Critical· 9.1Apache Kylin: Missing authorization and path-confinement on system meta dump
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common…
CVE-2026-64959Critical· 9.8Apache Kylin: Missing authentication on certain cache API endpoints
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public netwo…
CVE-2026-64610Critical· 9.8Apache Kylin: Redis unsafe Java deserialization
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade…