CVE-2026-62390

CriticalCVSS 9.8

Published: 14/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Summary

An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.

Risk Assessment

The risk includes unauthorized database access, data leakage or modification, and potential system compromise.

Recommendation

Immediately upgrade Apache Kylin to version 5.0.4, which fixes this vulnerability.

Other vulnerabilities in Apache Kylin

See all

CVE-2026-62392Critical
An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.
CVE-2026-62393Medium
An improper authorization vulnerability in Apache Kylin allows an attacker to access unauthorized jobs in other projects during job information retrieval.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.