CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Published Oct 16, 2026
·Updated
Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected Software
1 affected component
Apache Kylin>=4<=5.0.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kylinto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Oct 16, 2026
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Apache Kylin versions 4 through 5.0.4 are affected. Version 5.0.5 fixes the issue.
2
What information could be exposed?
The vulnerability allows an unauthorized actor to access the SQL blacklist through QuerySQLBlacklistController.
3
What should teams do to remediate this issue?
Upgrade Apache Kylin to version 5.0.5.