CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env
Apache Kylin CVE-2026-68572 allows unauthorized SQL execution in the Spark SQL environment.
Li Yang reported CVE-2026-68572 in Apache Kylin, rated important, describing unauthorized SQL execution against the Spark SQL environment. The oss-security post gives no affected-version range, exploit details, or evidence of in-the-wild use. Administrators should review the Apache Kylin advisory and apply the vendor fix when available.
- CVE-2026-68572 is rated important by Apache.
- The flaw allows unauthorized SQL execution in the Spark SQL environment.
- The oss-security note does not report in-the-wild exploitation.
Vulnerabilities mentionedAll →
- Sensitive information exposure in Apache Kylin 4–5.0.4published · Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-68572 | Sensitive information exposure in Apache Kylin 4–5.0.4 Apache Kylin versions from 4 through 5.0.4 have an exposure-of-sensitive-information flaw (CWE-200) that can let an unauthorized actor obtain data they should not see. The Apache advisory does not describe a detailed trigger; related reporting characterizes the issue as unauthorized SQL execution into the Spark SQL environment. An attacker who can reach a vulnerable instance may disclose sensitive information handled by Kylin. Organizations running Apache Kylin in that version range are affected, and the vendor fix is 5.0.5. No public proof of concept is known, the issue is not in CISA KEV, and exploitation in the wild is not known. Do: Upgrade Apache Kylin to 5.0.5. Until the upgrade is complete, restrict network access to Kylin and its Spark SQL interfaces to trusted users and review logs for unexpected SQL or data-access activity. |
Posted by Li Yang on Oct 15 Severity: important https://kylin.apache.org/...
This source does not provide full text. Read it at seclists.org.