CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Apache Kylin through 5.0.4 lets unauthorized users read the SQL blacklist.
Li Yang reported CVE-2026-69080, a broken access control flaw in Apache Kylin's QuerySQLBlacklistController that exposes the SQL blacklist to an unauthorized actor. It affects versions from 4.0.0 through 5.0.4 and is rated important. Apache recommends upgrading to 5.0.5. Finders include researchers from Fudan University's System and Software Security Lab and Yan Xu.
- Affects Apache Kylin 4.0.0 through 5.0.4
- Unauthorized access to the SQL blacklist
- Apache rates the issue important
- Fixed in version 5.0.5
- CVEs
- CVE-2026-69080CVE-2026-108743CVE-2026-108766CVE-2026-108771CVE-2026-108823CVE-2026-108776CVE-2026-108709CVE-2026-69077CVE-2026-108764CVE-2026-108762CVE-2026-108780CVE-2026-108837
- Vendors
- Apache
- Products
- Apache Kylin
- Organizations
- Apache Software FoundationFudan University
Coverage
oldest first · one row per article · UTC- · 14d ago
oss-securityFirst report
CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation
Apache Kylin 4 through 5.0.4 lets unauthorized users manipulate jobs across projects; upgrade to 5.0.5.
- · 14d ago
CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Apache Kylin through 5.0.4 lets unauthorized users read the SQL blacklist.
- · 14d ago
CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Apache Kylin 4.0.4 through 5.0.4 can broadcast metadata without authentication on internal networks.
- · 14d ago
CVE-2026-108743: Apache Kylin: spark job OS command injection
Apache Kylin 4.0.4 through 5.0.4 has a moderate OS command injection in Spark jobs.
- · 14d ago
CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass
Apache Kylin 4.0.0 through 5.0.4 has a moderate metadata-backup path bypass, fixed in 5.0.5.
- · 14d ago
CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF
Apache Kylin 4.0.0 through 5.0.4 has a moderate job-driver SSRF flaw, fixed in 5.0.5.
- · 14d ago
CVE-2026-108766: Apache Kylin: missing JDBC-config authorization
Apache Kylin 4.0.0 through 5.0.4 lacks JDBC-config authorization; users should upgrade to 5.0.5.
- · 14d ago
CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
Apache Kylin’s broadcast API lacks authentication and allows polymorphic deserialization through 5.0.4.
- · 14d ago
CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection
Apache Kylin 4.0.0–5.0.4 allows SparkSQL injection via table names, fixed in 5.0.5.
- · 14d ago
CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue
Apache Kylin 4.0.0–5.0.4 has a minor JDBC validation flaw fixed in 5.0.5.
- · 14d ago
CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement
Apache Kylin 4.0.0–5.0.4 may allow unauthenticated replacement of job metadata if services are exposed.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-108709+2 related CVEs | Authentication bypass in Apache Kylin 4.0.4–5.0.4 | 9.8 group max | — | ||
| CVE-2026-108762 | Path-confinement bypass during metadata backup deletion in Apache Kylin | 7.3 | — | ||
| CVE-2026-108764 | Server-Side request forgery (SSRF) vulnerability in Apache Kylin | 6.5 | — | ||
| CVE-2026-108766 | Missing authorization on jdbc source config update in Apache Kylin | 6.5 | — | ||
| CVE-2026-108771 | Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin | 9.8 | — | ||
| CVE-2026-108776 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin | 5.3 | — | ||
| CVE-2026-108780 | Potential JDBC source configuration validation vulnerability in Apache Kylin | 6.5 | — | ||
| CVE-2026-108823 | Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin | — | — | ||
| CVE-2026-108837 | Allocation of resources without limits or throttling vulnerability in Apache Kylin | — | — | ||
| CVE-2026-69077 | Unauthorized cross-project job manipulation in Apache Kylin | 7.5 | — |