CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kylinto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Frequently Asked Questions
What conditions are required for exploitation?
Exploitation requires a broken external cache service that can supply untrusted serialized data to Apache Kylin. The issue is associated with unsafe Java deserialization from that cache service.
Which deployments should be prioritized for remediation?
Apache Kylin deployments running versions 4 through 5.0.4 that use an external cache service should be prioritized, particularly where the cache service may be exposed, misconfigured, or otherwise untrusted.
What is the available fix?
Upgrade Apache Kylin to version 5.0.5. This version fixes the unsafe Java deserialization issue.