Live › vulnerability › CVE-2026-68571
Go to dashboardApache Kylin's JDBC URL whitelist check can be bypassed with a special URL parameter, which leads to code injection on the Kylin server. Apache rates it moderate and says it mostly matters for Kylin exposed directly to the public internet; in-house deployments are mostly not affected. NVD scores it 8.8 and the vector needs low privileges (a valid login). The vulnerable parameter is not published. No public PoC or exploitation is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Apache Kylin | maven | >= 4.0.0, <= 5.0.4 | 5.0.5 |
4.0.0 through 5.0.4 are affected5.0.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-68571")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.