CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass
Apache Kylin CVE-2026-68571 lets crafted JDBC URLs bypass whitelist checks and inject code.
Apache Kylin versions 4.0.0 through 5.0.4 are affected by CVE-2026-68571, a moderate-severity code-injection flaw in which a special JDBC URL parameter bypasses whitelist verification. Apache says impact is greatest for Kylin services exposed directly to the public internet, which is uncommon, and that typical in-house deployments are mostly not affected. The disclosure does not report observed exploitation.
- CVE-2026-68571 affects Apache Kylin 4.0.0 through 5.0.4.
- A special JDBC URL parameter can bypass whitelist checks and cause code injection.
- Apache rates it moderate; internet-exposed Kylin services are uncommon.
- No exploitation in the wild is reported.
Vulnerabilities mentionedAll →
- JDBC URL code injection in Apache Kylinpublished · Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-68571 | JDBC URL code injection in Apache Kylin Apache Kylin versions 4 through 5.0.4 contain a code-injection flaw (CWE-94) in which a special parameter in a JDBC URL bypasses whitelist verification and can cause code injection. An attacker who can supply that JDBC URL parameter may execute injected code in the Kylin process. Impact is greatest for Kylin services exposed directly to the public network, which the vendor says is uncommon; typical in-house deployments are mostly not affected. No CVSS score, public proof-of-concept, or CISA KEV listing is known. Users should upgrade to 5.0.5. Do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services directly to the public internet, and restrict who can supply JDBC connection URLs. | — |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4...
This source does not provide full text. Read it at seclists.org.