---
id: "CVE-2026-64959"
kind: "vulnerability"
aliases: ["CVE-2026-64959"]
title: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "big-data", "package", "self-hosted"]
not_affected_if: ["in-house-only-network", "not-kylin-5", "version-5.0.5-or-later"]
published_at: "2026-10-16T13:16:57+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64959", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…

Apache Kylin 5.0 through 5.0.4 has a backend cache API that skips authentication, and it passes input into SQL without neutralizing it. An attacker who can reach that API can run injected SQL against the Kylin backend.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the deployed Apache Kylin version (5.0.0 through 5.0.4 are affected) and whether the Kylin service is reachable from the public internet.

## Fix

Upgrade Apache Kylin to 5.0.5. Until then, block public network access to Kylin services.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64959

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_