{"id":"CVE-2026-64959","kind":"vulnerability","aliases":["CVE-2026-64959"],"related":[],"title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin 5.0 through 5.0.4 has a backend cache API that skips authentication, and it passes input into SQL without neutralizing it. An attacker who can reach that API can run injected SQL against the Kylin backend.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","big-data","package","self-hosted"],"not_affected_if":["in-house-only-network","not-kylin-5","version-5.0.5-or-later"],"how_to_check":"Check the deployed Apache Kylin version (5.0.0 through 5.0.4 are affected) and whether the Kylin service is reachable from the public internet.","fix":"Upgrade Apache Kylin to 5.0.5. Until then, block public network access to Kylin services.","status":"open","published_at":"2026-10-16T13:16:57+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:05:08+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:05:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Kylin to 5.0.5. Until then, block public network access to Kylin services.","reach":"internet","impact":"high","summary":"Apache Kylin 5.0 through 5.0.4 has a backend cache API that skips authentication, and it passes input into SQL without neutralizing it. An attacker who can reach that API can run injected SQL against the Kylin backend.","category":"package","who_cares":["apache-kylin","self-hosted","big-data"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs injected SQL against the Kylin backend without logging in","analyst_note":"","how_to_check":"Check the deployed Apache Kylin version (5.0.0 through 5.0.4 are affected) and whether the Kylin service is reachable from the public internet.","needs_analyst":false,"not_affected_if":["in-house-only-network","version-5.0.5-or-later","not-kylin-5"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000469,"input_tokens":2848,"output_tokens":368,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-64959':17A,20A '5':121C '5.0':33B '5.0.4':35B,123C '5.0.5':145C 'affect':117C 'apach':22B,31B,87C,118C 'apache-kylin':21B 'api':40B,59B,127C 'attack':54B 'authent':14A,43B,81C,130C 'backend':38B,67B,125C 'big':25B 'big-data':24B 'cach':39B,126C 'caus':133C 'certain':124C 'command':10A,77C 'common':105C 'critic':83C 'cve':15A,18A 'data':26B 'deploy':110C 'direct':97C 'element':5A,72C 'execut':134C 'expos':98C 'fix':147C 'function':84C 'host':30B 'hous':108C 'impact':89C,114C 'improp':1A,68C 'in-hous':106C 'inject':12A,62B,79C,136C 'input':47B 'issu':116C,149C 'kylin':23B,32B,66B,88C,93C,109C,119C 'miss':13A,80C,128C 'most':112C 'network':101C 'neutral':2A,51B,69C 'packag':27B 'pass':46B 'public':100C 'reach':57B 'recommend':140C 'requir':129C 'run':61B 'self':29B 'self-host':28B 'servic':94C 'skip':42B 'special':4A,71C 'sql':9A,11A,49B,63B,76C,78C,137C 'upgrad':142C 'use':6A,73C 'user':138C 'version':144C 'vulner':85C 'without':50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64959","severity":null,"published_at":"2026-10-16T13:16:57+00:00","modified_at":"2026-10-20T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}