{"id":"CVE-2026-69080","kind":"vulnerability","aliases":["CVE-2026-69080"],"related":[],"title":"Apache Kylin: SQL blacklist exposed to unauthorized users","description":"Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4 through 5.0.4 expose the SQL black list to actors who should not see it. An attacker can read which SQL patterns the server blocks and use that to craft queries that bypass the filter.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["analytics","apache-kylin","package","self-hosted","sql"],"not_affected_if":["version-5.0.5-or-later"],"how_to_check":"- Check the installed Kylin version, for example `unknown` if the sources do not give a command; compare against `5.0.5`\n- Confirm whether the version is between `4.x` and `5.0.4`","fix":"- Upgrade Apache Kylin to `5.0.5`","status":"open","published_at":"2026-10-16T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:51+00:00","updated_at":"2026-10-25T03:24:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:24:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`","reach":"unknown","title":"Apache Kylin: SQL blacklist exposed to unauthorized users","impact":"medium","summary":"Apache Kylin versions 4 through 5.0.4 expose the SQL black list to actors who should not see it. An attacker can read which SQL patterns the server blocks and use that to craft queries that bypass the filter.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","sql","analytics"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker learns blocked SQL patterns and bypasses the filter","analyst_note":"Check the Apache Kylin security advisory and the NVD entry for the exact endpoint and whether authentication is required to read the blacklist.","how_to_check":"- Check the installed Kylin version, for example `unknown` if the sources do not give a command; compare against `5.0.5`\n- Confirm whether the version is between `4.x` and `5.0.4`","needs_analyst":true,"not_affected_if":["version-5.0.5-or-later"],"who_is_affected":"Teams running Apache Kylin from version 4 through 5.0.4 are affected. The sources do not say which deployment modes or access setups make the blacklist reachable, so the exposure path is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000584,"input_tokens":3305,"output_tokens":507,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-69080':11A,14A '4':27B,81C '5.0.4':29B,83C '5.0.5':91C 'actor':36B,70C 'affect':77C 'analyt':15B 'apach':1A,17B,24B,73C,78C 'apache-kylin':16B 'attack':43B 'black':33B,65C 'blacklist':4A 'block':51B 'bypass':59B 'craft':56B 'cve':9A,12A 'expos':5A,30B 'exposur':62C 'filter':61B 'fix':93C 'host':22B 'issu':76C,95C 'kylin':2A,18B,25B,74C,79C 'list':34B,66C 'packag':19B 'pattern':48B 'queri':57B 'read':45B 'recommend':86C 'see':40B 'self':21B 'self-host':20B 'server':50B 'sql':3A,23B,32B,47B,64C 'unauthor':7A,69C 'upgrad':88C 'use':53B 'user':8A,84C 'version':26B,90C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Kylin from version 4 through 5.0.4 are affected. The sources do not say which deployment modes or access setups make the blacklist reachable, so the exposure path is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69080","severity":null,"published_at":"2026-10-16T20:17:24+00:00","modified_at":"2026-10-20T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}