Not rated
CVE-2026-64959 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Kylin 5.0 | 5.0.0 → 5.0.4 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Kylin
The 40 CVEs of Apache Kylin →
CVE-2026-108837
Apache Kylin: Potential computed-column resource exhaustion
Not rated
CVE-2026-108833
Apache Kylin: default startup profile miss security settings
Not rated
CVE-2026-108823
Apache Kylin: Potential unauthenticated job metadata replacement
Not rated
CVE-2026-108780
Potential JDBC source configuration validation vulnerability in Apache Kylin
Not rated