CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints

Q: Which deployments are most exposed to this issue?

Apache Kylin services directly exposed to the public network are most affected. The provided advisory notes that in-house deployments are mostly not impacted.

Q: What does an attacker need to exploit the vulnerability?

An attacker must be able to reach the affected backend cache API endpoints that lack required authentication. Those endpoints can be used to trigger execution of injected SQL.

Q: Are Apache Kylin 5.x deployments affected by default?

The issue affects Apache Kylin versions from 5 through 5.0.4. Exposure depends on whether the affected backend cache APIs are reachable, particularly from a public network.

Q: What is the recommended remediation?

Upgrade Apache Kylin to version 5.0.5, which fixes the issue.

Published Oct 16, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.

This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=5<=5.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Event History

Oct 16, 2026

CVE Published

via MITRE·12:16 PM

Data Sourced

via MITRE·12:16 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Apache Kylin services directly exposed to the public network are most affected. The provided advisory notes that in-house deployments are mostly not impacted.

What does an attacker need to exploit the vulnerability?

An attacker must be able to reach the affected backend cache API endpoints that lack required authentication. Those endpoints can be used to trigger execution of injected SQL.

Are Apache Kylin 5.x deployments affected by default?

The issue affects Apache Kylin versions from 5 through 5.0.4. Exposure depends on whether the affected backend cache APIs are reachable, particularly from a public network.

What is the recommended remediation?

Upgrade Apache Kylin to version 5.0.5, which fixes the issue.

CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are Apache Kylin 5.x deployments affected by default?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are Apache Kylin 5.x deployments affected by default?

What is the recommended remediation?