Unsafe Java deserialization in Apache Kylin via cache
Apache Kylin versions from 4 through 5.0.4 can unsafely deserialize untrusted Java objects when an external cache service, such as Redis, is broken or returns untrusted data. An attacker who can influence that cache may trigger Java deserialization (CWE-502) in the Kylin process. Impact depends on the gadgets available on the classpath and can include remote code execution in the worst case. Organizations running affected Kylin releases with an external cache are exposed. There is no known public proof of concept, the issue is not listed in CISA KEV, and exploitation in the wild is not known.
What to do: Upgrade Apache Kylin to 5.0.5 or later. Until then, restrict network access to the external cache (such as Redis) so only trusted Kylin nodes can reach it, and treat any unexpected cache outage or cache content as a potential deserialization trigger.
| Apache Kylin | 4 through 5.0.4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Apache Kylin through 5.0.4 can unsafely deserialize Java data from a broken Redis cache.
Apache disclosed CVE-2026-64610, a moderate deserialization-of-untrusted-data flaw in Apache Kylin. Unsafe Java deserialization can occur when an external Redis cache service is broken. Versions from 4 through 5.0.4 are affected, and users should upgrade to 5.0.5. No in-the-wild exploitation is mentioned.