CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kylinto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Apache Kylin services directly exposed to the public network are most affected. The available information indicates that typical in-house Kylin deployments are mostly not impacted.
What condition enables exploitation?
An attacker must be able to use a specially crafted parameter in a JDBC URL. That parameter can bypass JDBC URL whitelist verification and lead to code injection.
What versions should be remediated?
Apache Kylin versions from 4 through 5.0.4 are affected. Upgrade to version 5.0.5, which fixes the issue.