CVE-2026-62392
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the server, leading to full system compromise, data theft, or service disruption.
Recommendation
Upgrade Apache Kylin to version 5.0.4 immediately, which contains the fix for this vulnerability.
Other vulnerabilities in Apache Kylin
See all- CVE-2026-62390Critical
An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.
- CVE-2026-62393Medium
An improper authorization vulnerability in Apache Kylin allows an attacker to access unauthorized jobs in other projects during job information retrieval.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.