CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kylinto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Apache Kylin services directly exposed to the public network are most affected. The provided advisory notes that in-house deployments are mostly not impacted.
What does an attacker need to exploit the vulnerability?
An attacker must be able to reach the affected backend cache API endpoints that lack required authentication. Those endpoints can be used to trigger execution of injected SQL.
Are Apache Kylin 5.x deployments affected by default?
The issue affects Apache Kylin versions from 5 through 5.0.4. Exposure depends on whether the affected backend cache APIs are reachable, particularly from a public network.
What is the recommended remediation?
Upgrade Apache Kylin to version 5.0.5, which fixes the issue.