Apache Software Foundation Apache Kylin vulnerabilities

CVE-2026-69080 [HIGH] CWE-200 CVE-2026-69080: Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue aff Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2025-30067 [HIGH] CWE-94 CVE-2025-30067: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an atta Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected. This issue af

CVE-2025-61735 [HIGH] CWE-918 CVE-2025-61735: Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

CVE-2023-29055 [HIGH] CWE-522 CVE-2023-29055: In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the con In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.propert

CVE-2026-63618 [HIGH] CWE-200 CVE-2026-63618: Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnera Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2021-45457 [HIGH] CWE-863 CVE-2021-45457: In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

CVE-2026-68572 [HIGH] CWE-200 CVE-2026-68572: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This is Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2021-36774 [MEDIUM] CVE-2021-36774: Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache

CVE-2024-48944 [MEDIUM] CWE-918 CVE-2024-48944: Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacke Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the "/kylin/api/x

CVE-2026-108776 CWE-89 CVE-2026-108776: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108771 CWE-306 CVE-2026-108771: Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apach Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade t

CVE-2026-108764 CWE-918 CVE-2026-108764: Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job servi Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108762 CVE-2026-108762: Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin se Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108837 CWE-770 CVE-2026-108837: Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacke Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108780 CVE-2026-108780: Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, u Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108766 CVE-2026-108766: Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin service Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108823 CWE-200 CVE-2026-108823: Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108833 CVE-2026-108833: Default startup profile miss security settings in Apache Kylin. Any deployment has security setting Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-62393 [MEDIUM] CWE-280 CVE-2026-62393: Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.