Apache Kylin (Product): news timeline & CVEs

[AINews] Agents disprove Polysemanticity; greatly improve Interpretability & Alignment

Meta released Muse Spark Open, an 816B MoE that leads US open-weight models on Artificial Analysis.

Meta released Muse Spark Open, an 816B-total / 42B-active mixture-of-experts model with a 1M-token context and text, image, video, and audio input. Artificial Analysis scores it 39, first among US open-weight models but behind GLM-5.3 (45) and Kimi K3 (44); launch pricing is $1.25/$4.25 per million input/output tokens. The same roundup covers a Goodfire interpretability essay and launches of NVIDIA Nemotron 3.5 Super VL and Microsoft’s roughly 3T-parameter MAI-Base-2.

Latent SpaceOct 16, 04:16 UTC · 21h agoModel release 7 sources2· 1 read

CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion

Apache Kylin 4.0.0–5.0.4 lets project admins exhaust computed-column resources through a cache API.

CVE-2026-108837 is a low-severity resource-allocation flaw in Apache Kylin 4.0.0 through 5.0.4. A user who already has project-admin permission can use a cache API to exhaust resources associated with computed columns. Apache recommends upgrading to 5.0.5; no exploitation is reported.

oss-securityOct 16, 04:12 UTC · 21h agoVulnerability 4 sources CVE-2026-1088371· 1 read

CVE-2026-108833: Apache Kylin: default startup profile miss security settings

Apache Kylin’s default startup profile omits security settings in versions 4.0.0 through 5.0.4.

CVE-2026-108833 affects Apache Kylin 4.0.0 through 5.0.4 because the default startup profile omits security settings. Deployments that explicitly enable the security-settings profile are not affected. Apache rates it low and recommends upgrading to 5.0.5; it is tracked as KYLIN-6113.

oss-securityOct 16, 04:10 UTC · 21h agoVulnerability CVE-2026-1088332

CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement

Apache Kylin 4.0.0–5.0.4 may allow unauthenticated replacement of job metadata if services are exposed.

CVE-2026-108823 is a moderate-severity flaw in Apache Kylin 4.0.0 through 5.0.4 that can allow unauthenticated replacement of job metadata and exposure of sensitive information. Apache says the impact is minor unless job services are exposed to a public network, which it describes as uncommon. Users should upgrade to 5.0.5; exploitation is not reported.

oss-securityOct 16, 04:08 UTC · 21h agoVulnerability 4 sources CVE-2026-1088231

CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue

Apache Kylin 4.0.0–5.0.4 has a minor JDBC validation flaw fixed in 5.0.5.

Apache Kylin 4.0.0 through 5.0.4 has a JDBC source configuration validation issue tracked as CVE-2026-108780 and KYLIN-6111. The project rates it moderate and says impact is minor unless Kylin backend services are exposed to the public network. Users are advised to upgrade to 5.0.5. No exploitation is reported.

oss-securityOct 16, 04:06 UTC · 21h agoVulnerability 4 sources CVE-2026-1087801

CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection

Apache Kylin 4.0.0–5.0.4 allows SparkSQL injection via table names, fixed in 5.0.5.

CVE-2026-108776 is an SQL injection in Apache Kylin table-name handling for SparkSQL, affecting versions 4.0.0 through 5.0.4. Apache rates the impact moderate when Kylin runs in query-only mode, which is the default and most common deployment. The fix is version 5.0.5. The advisory does not report active exploitation.

oss-securityOct 16, 04:04 UTC · 21h agoVulnerability CVE-2026-1087762· 1 read

CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization

Apache Kylin’s broadcast API lacks authentication and allows polymorphic deserialization through 5.0.4.

CVE-2026-108771 covers missing authentication on Apache Kylin’s in-house broadcast API together with polymorphic deserialization, affecting 4.0.0 through 5.0.4. Apache rates it moderate and says impact is greatest when services are exposed to the public network, which is uncommon. Typical internal deployments are mostly not affected. Users should upgrade to 5.0.5; exploitation is not reported.

oss-securityOct 16, 04:02 UTC · 21h agoVulnerability CVE-2026-1087712

CVE-2026-108766: Apache Kylin: missing JDBC-config authorization

Apache Kylin 4.0.0 through 5.0.4 lacks JDBC-config authorization; users should upgrade to 5.0.5.

A moderate-severity flaw, CVE-2026-108766, affects Apache Kylin 4.0.0 through 5.0.4. Missing authorization allows updates to JDBC source configuration. Impact is greatest when Kylin is exposed to the public internet, which the project says is uncommon; typical in-house deployments are mostly unaffected. Users are advised to upgrade to 5.0.5.

oss-securityOct 16, 04:00 UTC · 21h agoVulnerability CVE-2026-1087662· 1 read

CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF

Apache Kylin 4.0.0 through 5.0.4 has a moderate job-driver SSRF flaw, fixed in 5.0.5.

Apache disclosed CVE-2026-108764, a moderate server-side request forgery flaw in the Apache Kylin job-driver UI proxy. It affects Kylin 4.0.0 through 5.0.4, with the greatest impact on job services exposed to the public internet, which Apache says is uncommon. Users are advised to upgrade to 5.0.5. No exploitation is reported.

oss-securityOct 16, 03:58 UTC · 21h agoVulnerability CVE-2026-1087641

CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass

Apache Kylin 4.0.0 through 5.0.4 has a moderate metadata-backup path bypass, fixed in 5.0.5.

Apache disclosed CVE-2026-108762, a moderate path-confinement bypass during metadata backup deletion in Apache Kylin. Versions 4.0.0 through 5.0.4 are affected, mainly when Kylin services are directly exposed to the public network, which Apache says is uncommon. The fix is version 5.0.5. No in-the-wild exploitation is mentioned.

oss-securityOct 16, 03:57 UTC · 21h agoVulnerability CVE-2026-108762

CVE-2026-108743: Apache Kylin: spark job OS command injection

Apache Kylin 4.0.4 through 5.0.4 has a moderate OS command injection in Spark jobs.

Li Yang reported CVE-2026-108743, an OS command injection flaw in Apache Kylin affecting versions 4.0.4 through 5.0.4. Apache rates the issue moderate. Services exposed directly to the public internet are most at risk, which the project says is uncommon, and typical in-house deployments are mostly not impacted.

oss-securityOct 16, 03:55 UTC · 21h agoVulnerability CVE-2026-108743

CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

Apache Kylin 4.0.4 through 5.0.4 can broadcast metadata without authentication on internal networks.

Li Yang disclosed CVE-2026-108709, an authentication bypass that allows unauthenticated metadata broadcast in Apache Kylin 4.0.4 through 5.0.4. Apache rates it moderate and says impact is greatest for uncommon internet-exposed deployments; in-house installs are mostly not affected. Users are advised to upgrade to 5.0.5.

oss-securityOct 16, 03:53 UTC · 21h agoVulnerability CVE-2026-108709

CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController

Apache Kylin through 5.0.4 lets unauthorized users read the SQL blacklist.

Li Yang reported CVE-2026-69080, a broken access control flaw in Apache Kylin's QuerySQLBlacklistController that exposes the SQL blacklist to an unauthorized actor. It affects versions from 4.0.0 through 5.0.4 and is rated important. Apache recommends upgrading to 5.0.5. Finders include researchers from Fudan University's System and Software Security Lab and Yan Xu.

oss-securityOct 16, 03:51 UTC · 22h agoVulnerability 2 sources CVE-2026-69080

CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation

Apache Kylin 4 through 5.0.4 lets unauthorized users manipulate jobs across projects; upgrade to 5.0.5.

Apache disclosed CVE-2026-69077, an important authorization flaw in Apache Kylin JobController affecting versions 4 through 5.0.4. An unauthorized actor can manipulate jobs across projects. The project says impact is greatest for uncommon internet-exposed deployments and that typical in-house installs are mostly unaffected. Users should upgrade to 5.0.5. No exploitation is reported.

oss-securityOct 16, 03:49 UTC · 22h agoVulnerability CVE-2026-69077

CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard

Apache Kylin 4 through 5.0.4 allows unauthorized actors to discard jobs across projects; fixed in 5.0.5.

Apache disclosed CVE-2026-69076, rated important, in Apache Kylin versions 4 through 5.0.4. The flaw exposes job-discard operations to an unauthorized actor across projects. Impact is described as mainly relevant to the uncommon case of Kylin services exposed directly to the public network. Version 5.0.5 fixes the issue, and no in-the-wild exploitation is stated.

oss-securityOct 16, 03:47 UTC · 22h agoVulnerability CVE-2026-69076

CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup

Unauthenticated users can trigger Apache Kylin metastore cleanup on versions 4 through 5.0.4; patch is 5.0.5.

Apache disclosed CVE-2026-68573, a moderate improper-authentication issue in Apache Kylin 4.0.0 through 5.0.4. An unauthenticated user may access system cleanup actions, including metastore cleanup. The advisory says services exposed directly to the public network are most affected and that this deployment pattern is uncommon. Users are advised to upgrade to 5.0.5. Exploitation is not reported.

oss-securityOct 16, 03:46 UTC · 22h agoVulnerability CVE-2026-68573

CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env

Apache Kylin CVE-2026-68572 allows unauthorized SQL execution in the Spark SQL environment.

Li Yang reported CVE-2026-68572 in Apache Kylin, rated important, describing unauthorized SQL execution against the Spark SQL environment. The oss-security post gives no affected-version range, exploit details, or evidence of in-the-wild use. Administrators should review the Apache Kylin advisory and apply the vendor fix when available.

oss-securityOct 16, 03:44 UTC · 22h agoVulnerability 2 sources CVE-2026-68572

CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass

Apache Kylin CVE-2026-68571 lets crafted JDBC URLs bypass whitelist checks and inject code.

Apache Kylin versions 4.0.0 through 5.0.4 are affected by CVE-2026-68571, a moderate-severity code-injection flaw in which a special JDBC URL parameter bypasses whitelist verification. Apache says impact is greatest for Kylin services exposed directly to the public internet, which is uncommon, and that typical in-house deployments are mostly not affected. The disclosure does not report observed exploitation.

oss-securityupdated Oct 16, 04:12 UTC · 21h agofirst Oct 16, 03:42 UTC · 22h agoVulnerability 4 sources CVE-2026-68571

CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints

Apache Kylin 5.0.0–5.0.4 cache APIs lack authentication and allow SQL injection.

Apache disclosed CVE-2026-64959, a critical flaw in Apache Kylin 5.0.0 through 5.0.4 combining missing authentication on certain cache API endpoints with SQL injection. The greatest impact is on Kylin services exposed directly to the public internet, which Apache says is uncommon; typical in-house deployments are mostly unaffected. Exploitation in the wild is not reported.

oss-securityOct 16, 03:40 UTC · 22h agoVulnerability 2 sources CVE-2026-64959

CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization

Apache Kylin through 5.0.4 can unsafely deserialize Java data from a broken Redis cache.

Apache disclosed CVE-2026-64610, a moderate deserialization-of-untrusted-data flaw in Apache Kylin. Unsafe Java deserialization can occur when an external Redis cache service is broken. Versions from 4 through 5.0.4 are affected, and users should upgrade to 5.0.5. No in-the-wild exploitation is mentioned.

oss-securityOct 16, 03:38 UTC · 22h agoVulnerability CVE-2026-64610

CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump

Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.

Apache disclosed CVE-2026-63619, a moderate missing-authorization flaw in Apache Kylin. A backend system metadata dump API lacks sufficient authorization and path confinement. It affects versions from 4 through 5.0.4, mainly when services are exposed to the public network, which Apache says is uncommon.

oss-securityOct 16, 03:36 UTC · 22h agoVulnerability 2 sources CVE-2026-63619

CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure

Low-privilege users can read Apache Kylin system configuration through version 5.0.4.

Apache disclosed CVE-2026-63618, an important information-exposure flaw in Apache Kylin. Low-privilege users can access system-level configuration information they should not see. Versions from 4 through 5.0.4 are affected, and Apache recommends upgrading to 5.0.5. No exploitation is reported.

oss-securityOct 16, 03:34 UTC · 22h agoVulnerability CVE-2026-63618

Apache Kylin

Timeline22 articles

Related CVEsby mentions

Appears with