Two important Apache Kylin flaws disclosed

Apache Kylin has two important flaws: unauthorized Spark SQL execution and SQL-blacklist access fixed in 5.0.5.

Two important Apache Kylin issues were posted to oss-security on 16 October 2026, both reported by Li Yang. CVE-2026-68572 allows unauthorized SQL execution in the Spark SQL environment; that note does not give an affected-version range, exploit details, or evidence of in-the-wild use, and tells administrators to review the vendor advisory and apply a fix when available. Separately, CVE-2026-69080 is a broken access control flaw in QuerySQLBlacklistController that exposes the SQL blacklist to an unauthorized actor. It affects versions 4.0.0 through 5.0.4, and Apache recommends upgrading to 5.0.5. Finders for CVE-2026-69080 include researchers from Fudan University's System and Software Security Lab and Yan Xu. The two posts do not contradict each other; they describe different flaws.

• Li Yang reported CVE-2026-68572 in Apache Kylin, rated important, allowing unauthorized SQL execution against the Spark SQL environment.
• The oss-security note on CVE-2026-68572 gives no affected-version range, exploit details, or evidence of in-the-wild use.
• Li Yang also reported CVE-2026-69080, a broken access control flaw in QuerySQLBlacklistController that lets an unauthorized actor read the SQL blacklist.
• CVE-2026-69080 affects Apache Kylin 4.0.0 through 5.0.4, is rated important, and is fixed in 5.0.5.
• Finders named for CVE-2026-69080 include researchers from Fudan University's System and Software Security Lab and Yan Xu.
• Administrators are advised to review the Apache Kylin advisory for CVE-2026-68572 and apply the vendor fix when available, and to upgrade to 5.0.5 for CVE-2026-69080.