How do I check whether I am affected by CVE-2026-64610?

Check the deployed Kylin version in the installed package or release files; affected if it is 4.x through 5.0.4. If an external cache service is configured for Kylin, note its host and who can write to it.

What is the fix for CVE-2026-64610?

Upgrade Apache Kylin to version 5.0.5. Until then, restrict who can write to the external cache service (unknown whether this is a complete mitigation).

Who is not affected by CVE-2026-64610?

Not affected if: default-config.

Live › vulnerability › CVE-2026-64610

Go to dashboard

critical9.8Package

Deserialization of Untrusted Data vulnerability in Apache Kylin

Apache Kylin versions 4 through 5.0.4 deserialize untrusted Java objects from an external cache service. An attacker who can make the cache service return crafted data can run code on the Kylin server.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 20, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Attacker runs code on the Kylin server via deserialization.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-64610

Go to dashboard

critical9.8Package

Deserialization of Untrusted Data vulnerability in Apache Kylin

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 20, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Attacker runs code on the Kylin server via deserialization.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

Deserialization of Untrusted Data vulnerability in Apache Kylin

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Deserialization of Untrusted Data vulnerability in Apache Kylin

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources