CVE-2026-64610
UnknownSummary
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin from 4 through 5.0.4.
Risk Assessment
A failure or compromise of the external cache service may lead to unsafe Java deserialization and consequently code execution on the Kylin server.
Recommendation
Upgrade Apache Kylin to version 5.0.5, which fixes the issue; secure and monitor external cache services used by Kylin.
Other vulnerabilities in Apache Kylin
See all- CVE-2026-63618High
Apache Kylin exposes sensitive information (system-level configuration info) to an unauthorized actor. This issue affects Apache Kylin from 4 through 5.0.4.
- CVE-2026-64959Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') and Missing Authentication for Critical Function vulnerability in Apache Kylin. Certain backend cache API misses required authentication and can cause execution of injected SQL. This issue affects Apache Kylin from 5 through 5.0.4 and impacts most the Kylin services directly exposed to the public network.
- CVE-2026-63619Critical
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses enough authorization and path-confinement. This issue affects Apache Kylin from 4 through 5.0.4 and impacts most the Kylin services directly exposed to the public network.
- CVE-2026-62392Critical
An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.
- CVE-2026-62390Critical
An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.
- CVE-2025-61734High
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- CVE-2020-1956HighActively exploited
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
- CVE-2026-108837Low risk· EPSS 9%
In Apache Kylin from 4.0.0 through 5.0.4, an attacker with project admin permission may use a cache API to cause computed-column resource exhaustion. This is an allocation of resources without limits or throttling.
- CVE-2026-108833Low risk· EPSS 9%
In Apache Kylin from 4.0.0 through 5.0.4, the default startup profile misses security settings. Any deployment with the security setting profile turned on is not impacted.
- CVE-2026-108823Low risk· EPSS 9%
A vulnerability in Apache Kylin involving exposure of sensitive information to an unauthorized actor during job manipulation. It affects versions 4.0.0 through 5.0.4 and has minor impact unless job services are exposed to the public network.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS