{"id":"CVE-2026-68571","kind":"vulnerability","aliases":["CVE-2026-68571"],"related":[],"title":"Apache Kylin: JDBC URL parameter lets attackers inject and run code","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. \nImpact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin's JDBC URL whitelist check can be bypassed with a special URL parameter, which leads to code injection on the Kylin server. Apache rates it moderate and says it mostly matters for Kylin exposed directly to the public internet; in-house deployments are mostly not affected. NVD scores it 8.8 and the vector needs low privileges (a valid login). The vulnerable parameter is not published. No public PoC or exploitation is known.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Kylin","fixed":["5.0.5"],"affected":">= 4.0.0, <= 5.0.4","ecosystem":"maven"}],"ecosystems":[],"tags":["apache-kylin","code-injection","data-platform","java","jdbc","package"],"not_affected_if":["in-house-deployment","internal-only","not-internet-exposed","version-above-5.0.4"],"how_to_check":"Check your Kylin version (UI About page or the kylin jar/package version). Versions 4.0.0 through 5.0.4 are affected. Also check whether the Kylin web/API port is reachable from the internet. The vulnerable parameter is not published, so there is no config-level check.","fix":"Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin to the public network and restrict who has accounts that can set JDBC connections.","status":"open","published_at":"2026-10-16T13:16:57+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:34:46+00:00","updated_at":"2026-10-24T00:27:43+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:34:46Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Kylin to version 5.0.5, which fixes the issue.","reach":"internet","title":"Apache Kylin: JDBC URL parameter lets attackers inject and run code","impact":"high","summary":"A special parameter in a JDBC URL in Apache Kylin lets an attacker inject code that the server then runs. The worst outcome is code execution on the Kylin server, mainly for Kylin services exposed directly to the public internet.","category":"package","who_cares":["apache-kylin","java","data-platform"],"confidence":0.6,"needs_auth":"unknown","worst_case":"code runs on the Kylin server","analyst_note":"Sources do not say which JDBC URL parameter or how to detect a vulnerable config; check the NVD entry and Apache Kylin advisory for details and whether authentication is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["in-house-deployment","version-above-5.0.4"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000484,"input_tokens":2961,"output_tokens":375,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not say which JDBC URL parameter or how to detect a vulnerable config; check the NVD entry and Apache Kylin advisory for details and whether authentication is required.","search":"'-2026':13A,16A '-68571':14A,17A '4':161C '5.0.4':163C '5.0.5':171C '8.8':84B 'affect':80B,157C 'apach':1A,21B,32B,56B,117C,158C 'apache':18A 'apache-kylin':20B 'attack':7A 'bypass':41B 'check':38B 'code':11A,24B,50B,112C,113C,127C 'code-inject':23B 'common':145C 'control':108C 'cve':12A,15A 'data':27B 'data-platform':26B 'deploy':76B,150C 'direct':68B,137C 'exploit':104B 'expos':67B,138C 'fix':173C 'generat':110C 'hous':75B,148C 'impact':129C,154C 'improp':107C 'in-hous':73B,146C 'inject':8A,25B,51B,114C,128C 'internet':72B 'issu':156C,175C 'java':29B 'jdbc':3A,30B,35B,122C 'known':106B 'kylin':2A,19A,22B,33B,54B,66B,118C,133C,149C,159C 'lead':48B,125C 'let':6A 'login':93B 'low':89B 'matter':64B 'moder':59B 'most':63B,78B,152C 'need':88B 'network':141C 'nvd':81B 'packag':31B 'paramet':5A,46B,96B,120C 'platform':28B 'poc':102B 'privileg':90B 'public':71B,101B,140C 'publish':99B 'rate':57B 'recommend':166C 'run':10A 'say':61B 'score':82B 'server':55B 'servic':134C 'special':44B,119C 'upgrad':168C 'url':4A,36B,45B,123C 'user':164C 'valid':92B 'vector':87B 'version':170C 'vulner':95B,115C 'whitelist':37B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68571","severity":null,"published_at":"2026-10-16T13:16:57+00:00","modified_at":"2026-10-19T11:17:18+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-68571:667","url":null,"severity":null,"published_at":"2026-10-24T00:27:43+00:00","modified_at":"2026-10-24T00:27:43+00:00","first_seen_at":"2026-10-24T00:27:43+00:00","fetched_at":"2026-10-24T00:27:43+00:00","note":"Read ASF announce (lists.apache.org, oss-security 2026-10-16): titled JDBC URL Whitelist Verification Bypass, Apache-rated moderate (CVSS 8.8 per NVD/Tenable, PR:L). Affected 4.0.0-5.0.4, fixed 5.0.5. Exact parameter not disclosed; no PoC or exploitation found; no social discussion searched."}],"documents":[{"id":2621,"url":"https://lists.apache.org/thread/vmjozo864ss37c1jbdlld9m6d84ndpbs","title":"CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass (ASF announce)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2622,"url":"https://www.openwall.com/lists/oss-security/2026/10/16/5","title":"oss-security: CVE-2026-68571 Apache Kylin","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}