CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController

Apache Kylin versions 4 through 5.0.4 are affected. Version 5.0.5 fixes the issue.

The vulnerability allows an unauthorized actor to access the SQL blacklist through QuerySQLBlacklistController.

Upgrade Apache Kylin to version 5.0.5.

Published Oct 16, 2026

Updated

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=4<=5.0.4

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Oct 16, 2026

CVE Published

via MITRE·07:37 PM

Data Sourced

via MITRE·07:37 PM

DescriptionWeakness

Apache Kylin versions 4 through 5.0.4 are affected. Version 5.0.5 fixes the issue.

The vulnerability allows an unauthorized actor to access the SQL blacklist through QuerySQLBlacklistController.

Upgrade Apache Kylin to version 5.0.5.