CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Apache Kylin through 5.0.4 lets unauthorized users read the SQL blacklist.
Li Yang reported CVE-2026-69080, a broken access control flaw in Apache Kylin's QuerySQLBlacklistController that exposes the SQL blacklist to an unauthorized actor. It affects versions from 4.0.0 through 5.0.4 and is rated important. Apache recommends upgrading to 5.0.5. Finders include researchers from Fudan University's System and Software Security Lab and Yan Xu.
- Affects Apache Kylin 4.0.0 through 5.0.4
- Unauthorized access to the SQL blacklist
- Apache rates the issue important
- Fixed in version 5.0.5
Vulnerabilities mentionedAll →
- Unauthorized SQL blacklist exposure in Apache Kylinpublished · Apache Software Foundation Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-69080 | Unauthorized SQL blacklist exposure in Apache Kylin Apache Kylin versions from 4 through 5.0.4 expose the SQL blacklist to an unauthorized actor through broken access control in QuerySQLBlacklistController (CWE-200). An attacker who can reach the affected controller can read blacklist contents they should not see, which can reveal blocked SQL patterns and related query rules. The issue is fixed in 5.0.5. It is not listed in CISA KEV, has no known public proof of concept, and has no known in-the-wild exploitation. Do: Upgrade Apache Kylin to 5.0.5 or later. Until then, restrict network access to the Kylin management and query APIs (including QuerySQLBlacklistController) to trusted administrators only, and review access logs for unauthorized reads of the SQL blacklist. |
Posted by Li Yang on Oct 15 Severity: important Affected versions: - Apache Kylin 4..0.0 through 5.0.4 Description: Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. Credit: Haoran Zhao, Yicheng Yu, and Lei Zhang (System and Software Security Lab in Fudan University) (finder) Yan Xu (finder) References:...
This source does not provide full text. Read it at seclists.org.