CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Apache Kylin 5.0.0–5.0.4 cache APIs lack authentication and allow SQL injection.
Apache disclosed CVE-2026-64959, a critical flaw in Apache Kylin 5.0.0 through 5.0.4 combining missing authentication on certain cache API endpoints with SQL injection. The greatest impact is on Kylin services exposed directly to the public internet, which Apache says is uncommon; typical in-house deployments are mostly unaffected. Exploitation in the wild is not reported.
- CVE-2026-64959 is rated critical by Apache.
- Missing authentication and SQL injection affect Kylin cache APIs.
- Versions 5.0.0 through 5.0.4 are affected.
- Internet-exposed deployments are most at risk; in-house installs usually are not.
Vulnerabilities mentionedAll →
- Unauthenticated SQL injection in Apache Kylin cache APIpublished · Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-64959 | Unauthenticated SQL injection in Apache Kylin cache API Apache Kylin 5 through 5.0.4 has a missing-authentication flaw on certain backend cache API endpoints that can lead to SQL injection. An unauthenticated attacker who can reach those endpoints can submit specially crafted input that is executed as SQL. The practical impact is highest for Kylin services exposed directly to the public network, which Apache says is not common; typical in-house deployments are mostly not affected. The issue is fixed in version 5.0.5. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known. Do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services to the public internet and restrict the backend cache APIs to trusted networks and authenticated callers only. Review access logs for unauthenticated requests to those cache endpoints. |
Posted by Li Yang on Oct 15 Severity: critical Affected versions: - Apache Kylin 5.0.0 through 5.0.4 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...
This source does not provide full text. Read it at seclists.org.