Apache Kylin 5.0.5 fixes five flaws including an unauthenticated SQL injection in a backend cache API (CVE-2026-64959, rated critical by Apache) — upgrade from 4.x–5.0.4
The Apache Kylin project published five CVE records on 16 October 2026 for the open-source OLAP analytics engine, all fixed in Kylin 5.0.5. CVE-2026-64959, which Apache rates critical, is a backend cache API that is missing authentication and can execute injected SQL (Kylin 5.0 to 5.0.4). The others, affecting Kylin 4 through 5.0.4, are CVE-2026-68571, code injection through a special parameter in a JDBC URL (moderate); CVE-2026-64610, unsafe Java deserialisation from a broken external cache service (moderate); CVE-2026-63619, a metadata dump API without enough authorisation or path confinement (moderate); and CVE-2026-63618, exposure of system configuration information (important; CISA's enrichment scores it CVSS 3.1 7.5). Apache says the impact falls mostly on Kylin services exposed directly to the internet, which it describes as uncommon, and that in-house deployments are mostly unaffected. No exploitation is reported. Primary: Apache Kylin advisories on the Apache security mailing list (16 Oct 2026).
- Product
- Apache Kylin (OLAP analytics engine)
- Versions
- Affected: Kylin 4 through 5.0.4 (CVE-2026-64959: 5.0 through 5.0.4). Fixed: 5.0.5.
- CVSS
- Apache severity: critical (CVE-2026-64959), important (CVE-2026-63618; CISA enrichment CVSS 3.1 7.5), moderate (the other three)
- Exploited in Australia?
- unknown
- Patch to
- Upgrade Apache Kylin to 5.0.5. Keep Kylin web and API endpoints off the internet and behind authentication, and review who can reach the cache and metadata APIs.
Primary: Apache Kylin — CVE-2026-64959 advisory (Apache mailing list, 16 Oct 2026) · Vendor: CVE-2026-64959 — Apache Software Foundation CNA (with CVE-2026-68571, 64610, 63619, 63618) · CVE: CVE-2026-64959, CVE-2026-68571, CVE-2026-64610, CVE-2026-63619, CVE-2026-63618 · Tenable — CVE-2026-64959