Apache Apache Kylin
41 CVEs affecting Apache Apache Kylin. Latest disclosed: 2026-10-19. Critical: 12, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68573 | Critical | 9.8 | 2026-10-16 | Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are di… |
CVE-2026-108709 | Critical | 9.8 | 2026-10-16 | Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not comm… |
CVE-2026-64959 | Critical | 9.8 | 2026-10-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kyli… |
CVE-2026-64610 | Critical | 9.8 | 2026-10-16 | Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue a… |
CVE-2026-62392 | Critical | 9.8 | 2026-07-14 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config pa… |
CVE-2026-62390 | Critical | 9.8 | 2026-07-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may… |
CVE-2022-44621 | Critical | 9.8 | 2022-12-30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
CVE-2022-24697 | Critical | 9.8 | 2022-10-13 | Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implem… |
CVE-2021-45456 | Critical | 9.8 | 2022-01-06 | Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what… |
CVE-2021-31522 | Critical | 9.8 | 2022-01-06 | Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3… |
CVE-2026-63619 | Critical | 9.1 | 2026-10-16 | Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the k… |
CVE-2024-23590 | Critical | 9.1 | 2024-11-04 | Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or… |
CVE-2026-108743 | High | 8.8 | 2026-10-16 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services tha… |
CVE-2026-68571 | High | 8.8 | 2026-10-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most… |
CVE-2022-43396 | High | 8.8 | 2022-12-30 | In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by co… |
CVE-2020-1937 | High | 8.8 | 2020-02-24 | Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. |
CVE-2026-69080 | High | 7.5 | 2026-10-16 | Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recom… |
CVE-2026-69077 | High | 7.5 | 2026-10-16 | Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public ne… |
CVE-2026-69076 | High | 7.5 | 2026-10-16 | Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network… |
CVE-2026-68572 | High | 7.5 | 2026-10-16 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users ar… |