CVE-2026-62390

CriticalCVSS 9.8

Published: 14/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Summary

An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.

Risk Assessment

The risk includes unauthorized database access, data leakage or modification, and potential system compromise.

Recommendation

Immediately upgrade Apache Kylin to version 5.0.4, which fixes this vulnerability.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.