---
id: "CVE-2026-69080"
kind: "vulnerability"
aliases: ["CVE-2026-69080"]
title: "Apache Kylin: SQL blacklist exposed to unauthorized users"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["analytics", "apache-kylin", "package", "self-hosted", "sql"]
not_affected_if: ["version-5.0.5-or-later"]
published_at: "2026-10-16T20:17:24+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:24:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69080", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Apache Kylin: SQL blacklist exposed to unauthorized users

Apache Kylin versions 4 through 5.0.4 expose the SQL black list to actors who should not see it. An attacker can read which SQL patterns the server blocks and use that to craft queries that bypass the filter.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kylin version, for example `unknown` if the sources do not give a command; compare against `5.0.5`
- Confirm whether the version is between `4.x` and `5.0.4`

## Fix

- Upgrade Apache Kylin to `5.0.5`

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-69080

## From the sources

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_