Live › vulnerability › CVE-2026-64959
Go to dashboardApache Kylin 5.0 through 5.0.4 has a backend cache API that skips authentication, and it passes input into SQL without neutralizing it. An attacker who can reach that API can run injected SQL against the Kylin backend.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the deployed Apache Kylin version (5.0.0 through 5.0.4 are affected) and whether the Kylin service is reachable from the public internet.
5.0.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-64959")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.