Actively exploited in the wild
Apache Kylin OS Command Injection Vulnerability
Apache - Kylin · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-1956
HighCVSS 8.8KEVSummary
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Risk Assessment
An attacker can execute arbitrary OS commands on the server, potentially leading to full system compromise and breach of data confidentiality, integrity, and availability.
Recommendation
Update Apache Kylin to a version newer than 2.6.5 or 3.0.1 that includes the fix for this vulnerability, and restrict access to the REST APIs.
Other vulnerabilities in Apache Kylin
See all- CVE-2026-62392Critical
An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.
- CVE-2026-62390Critical
An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.
- CVE-2026-62393Medium
An improper authorization vulnerability in Apache Kylin allows an attacker to access unauthorized jobs in other projects during job information retrieval.
Original NVD description (English source)
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.