CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization

Q: What conditions are required for exploitation?

Exploitation requires a broken external cache service that can supply untrusted serialized data to Apache Kylin. The issue is associated with unsafe Java deserialization from that cache service.

Q: Which deployments should be prioritized for remediation?

Apache Kylin deployments running versions 4 through 5.0.4 that use an external cache service should be prioritized, particularly where the cache service may be exposed, misconfigured, or otherwise untrusted.

Q: What is the available fix?

Upgrade Apache Kylin to version 5.0.5. This version fixes the unsafe Java deserialization issue.

Published Oct 16, 2026

Updated

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=4<=5.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Event History

Oct 16, 2026

CVE Published

via MITRE·12:13 PM

Data Sourced

via MITRE·12:13 PM

DescriptionWeakness

Frequently Asked Questions

What conditions are required for exploitation?

Exploitation requires a broken external cache service that can supply untrusted serialized data to Apache Kylin. The issue is associated with unsafe Java deserialization from that cache service.

Which deployments should be prioritized for remediation?

Apache Kylin deployments running versions 4 through 5.0.4 that use an external cache service should be prioritized, particularly where the cache service may be exposed, misconfigured, or otherwise untrusted.

What is the available fix?

Upgrade Apache Kylin to version 5.0.5. This version fixes the unsafe Java deserialization issue.

CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments should be prioritized for remediation?

What is the available fix?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments should be prioritized for remediation?

What is the available fix?