CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints

1 source · 8 articlesFirst reported Oct 16, 2026 · 03:34 UTCUpdated Oct 16, 2026 · 03:47 UTC (14d ago)

Merged summary · from the lead articleSummaries by Vani AI

Apache Kylin 5.0.0–5.0.4 cache APIs lack authentication and allow SQL injection.

Apache disclosed CVE-2026-64959, a critical flaw in Apache Kylin 5.0.0 through 5.0.4 combining missing authentication on certain cache API endpoints with SQL injection. The greatest impact is on Kylin services exposed directly to the public internet, which Apache says is uncommon; typical in-house deployments are mostly unaffected. Exploitation in the wild is not reported.

Key facts

CVE-2026-64959 is rated critical by Apache.
Missing authentication and SQL injection affect Kylin cache APIs.
Versions 5.0.0 through 5.0.4 are affected.
Internet-exposed deployments are most at risk; in-house installs usually are not.

Analyze CVE-2026-64959 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-64959 CVE-2026-68572 CVE-2026-63618 CVE-2026-69080 CVE-2026-64610 CVE-2026-108743 CVE-2026-63619 CVE-2026-108766 CVE-2026-108771 CVE-2026-68571 CVE-2026-68573 CVE-2026-108823

Vendors: Apache
Products: Apache Kylin
Organizations: Apache Software Foundation Fudan University

Coverage

oldest first · one row per article · UTC

Oct 16, 03:34 UTC · 14d ago oss-securityFirst report
CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure
Low-privilege users can read Apache Kylin system configuration through version 5.0.4.
Oct 16, 03:36 UTC · 14d ago oss-security
CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.
Oct 16, 03:38 UTC · 14d ago oss-security
CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization
Apache Kylin through 5.0.4 can unsafely deserialize Java data from a broken Redis cache.
Oct 16, 03:40 UTC · 14d ago oss-security
CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Apache Kylin 5.0.0–5.0.4 cache APIs lack authentication and allow SQL injection.
Oct 16, 03:42 UTC · 14d ago oss-security
CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass
Apache Kylin CVE-2026-68571 lets crafted JDBC URLs bypass whitelist checks and inject code.
Oct 16, 03:44 UTC · 14d ago oss-security
CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env
Apache Kylin CVE-2026-68572 allows unauthorized SQL execution in the Spark SQL environment.
Oct 16, 03:46 UTC · 14d ago oss-security
CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup
Unauthenticated users can trigger Apache Kylin metastore cleanup on versions 4 through 5.0.4; patch is 5.0.5.
Oct 16, 03:47 UTC · 14d ago oss-security
CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard
Apache Kylin 4 through 5.0.4 allows unauthorized actors to discard jobs across projects; fixed in 5.0.5.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Published
CVE-2026-64610 +3 related CVEs CVE-2026-108743 CVE-2026-68572 CVE-2026-69080	Unsafe Java deserialization in Apache Kylin via cache	9.8 group max	—	14d ago
CVE-2026-108766	Missing authorization on jdbc source config update in Apache Kylin	6.5	—	11d ago
CVE-2026-108771	Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin	9.8	—	11d ago
CVE-2026-108823	Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin	—	—	11d ago
CVE-2026-64959 +4 related CVEs CVE-2026-68573 CVE-2026-63619 CVE-2026-68571 CVE-2026-63618	Unauthenticated SQL injection in Apache Kylin cache API	9.8 group max	—	14d ago