CVE-2026-68571
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. A special parameter in a JDBC URL can lead to code injection. Impact is most severe for Kylin services directly exposed to the public network, which is not common; in-house Kylin deployments are mostly not impacted. This issue affects Apache Kylin from 4 through 5.0.4.
Risk Assessment
If a Kylin service is publicly exposed, an attacker may exploit code injection to perform unauthorized operations on the server. In-house deployments are mostly less exposed.
Recommendation
Upgrade Apache Kylin to version 5.0.5, which fixes the issue; additionally restrict public access to Kylin services.
Other vulnerabilities in Apache Kylin
See all- CVE-2026-63618High
Apache Kylin exposes sensitive information (system-level configuration info) to an unauthorized actor. This issue affects Apache Kylin from 4 through 5.0.4.
- CVE-2026-108771Critical
A vulnerability in Apache Kylin involving missing authentication for in-house broadcast and polymorphic deserialization. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.
- CVE-2026-68573Critical
Improper Authentication vulnerability in Apache Kylin. An unauthenticated user may access system cleanup actions. The issue affects versions from 4 through 5.0.4.
- CVE-2026-108709Critical
Authentication bypass within in-house network in Apache Kylin. The issue affects versions from 4.0.4 through 5.0.4.
- CVE-2026-64959Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') and Missing Authentication for Critical Function vulnerability in Apache Kylin. Certain backend cache API misses required authentication and can cause execution of injected SQL. This issue affects Apache Kylin from 5 through 5.0.4 and impacts most the Kylin services directly exposed to the public network.
- CVE-2026-64610Critical
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin from 4 through 5.0.4.
- CVE-2026-63619Critical
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses enough authorization and path-confinement. This issue affects Apache Kylin from 4 through 5.0.4 and impacts most the Kylin services directly exposed to the public network.
- CVE-2026-62392Critical
An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.
- CVE-2026-62390Critical
An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.
- CVE-2025-61734High
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS