CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization

Apache Kylin versions from 4 through 5.0.4 can unsafely deserialize untrusted Java objects when an external cache service, such as Redis, is broken or returns untrusted data. An attacker who can influence that cache may trigger Java deserialization (CWE-502) in the Kylin process. Impact depends on the gadgets available on the classpath and can include remote code execution in the worst case. Organizations running affected Kylin releases with an external cache are exposed. There is no known public proof of concept, the issue is not listed in CISA KEV, and exploitation in the wild is not known.

Do: Upgrade Apache Kylin to 5.0.5 or later. Until then, restrict network access to the external cache (such as Redis) so only trusted Kylin nodes can reach it, and treat any unexpected cache outage or cache content as a potential deserialization trigger.