CVE-2026-68571
UnknownSummary
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. A special parameter in a JDBC URL can lead to code injection. Impact is most severe for Kylin services directly exposed to the public network, which is not common; in-house Kylin deployments are mostly not impacted. This issue affects Apache Kylin from 4 through 5.0.4.
Risk Assessment
If a Kylin service is publicly exposed, an attacker may exploit code injection to perform unauthorized operations on the server. In-house deployments are mostly less exposed.
Recommendation
Upgrade Apache Kylin to version 5.0.5, which fixes the issue; additionally restrict public access to Kylin services.
Other vulnerabilities in Apache Kylin
See all- CVE-2026-108837Unknown
In Apache Kylin from 4.0.0 through 5.0.4, an attacker with project admin permission may use a cache API to cause computed-column resource exhaustion. This is an allocation of resources without limits or throttling.
- CVE-2026-108833Unknown
In Apache Kylin from 4.0.0 through 5.0.4, the default startup profile misses security settings. Any deployment with the security setting profile turned on is not impacted.
- CVE-2026-108823Unknown
A vulnerability in Apache Kylin involving exposure of sensitive information to an unauthorized actor during job manipulation. It affects versions 4.0.0 through 5.0.4 and has minor impact unless job services are exposed to the public network.
- CVE-2026-108780Unknown
A potential JDBC source configuration validation vulnerability in Apache Kylin. It affects versions 4.0.0 through 5.0.4 and has minor impact unless Kylin backend services are open to the public network.
- CVE-2026-108776Unknown
An SQL Injection vulnerability in Apache Kylin due to improper neutralization of special elements used in SQL commands. It affects versions 4.0.0 through 5.0.4 and has moderate impact in the default query-only mode.
- CVE-2026-108771Unknown
A vulnerability in Apache Kylin involving missing authentication for in-house broadcast and polymorphic deserialization. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.
- CVE-2026-108766Unknown
A vulnerability in Apache Kylin involving missing authorization on JDBC source configuration updates. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.
- CVE-2026-108764Unknown
A Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. It affects versions 4.0.0 through 5.0.4 and impacts mainly the Kylin job service directly exposed to the public network.
- CVE-2026-108762Unknown
A path-confinement bypass vulnerability in Apache Kylin during metadata backup deletion. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.
- CVE-2026-69080Unknown
Exposure of the SQL Black List to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS