KY
Product
Kylin
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 11Medium 4Low 0
Watch
Add Kylin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1956 In wildKEV | 8.8 | May 22 | Apache Kylin OS Command Injection Vulnerability Affected: 2.3.0; <=2.6.5; <=3.0.1 |
| CVE-2026-62392 | 9.8 | Jul 14 | Apache Kylin: OS Command Injection via Async Query API Affected: 4.0.0 before 5.0.4 |
| CVE-2026-62390 | 9.8 | Jul 14 | Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API Affected: 4.0.0 before 5.0.4 |
| CVE-2022-44621 | 9.8 | Dec 30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request Affected: before 4.0.3 |
| CVE-2022-24697 | 9.8 | Oct 13 | Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters Affected: 2.0.0 before 2.6.6; 3.0.0 through 3.1.2; 4.0.0 through 4.0.1 |
| CVE-2021-45456 | 9.8 | Jan 6 | Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user Affected: 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-31522 | 9.8 | Jan 6 | Kylin can receive user input and load any class through Class.forName(...) Affected: 2.0.0 through 2.6.6; 3.0.0 before 3.1.3; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2020-13926 | 9.8 | Jul 14 | Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be… Affected: 2.0.0 before 3.1.0 |
| CVE-2020-13925 | 9.8 | Jul 14 | Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses… Affected: 2.3.0 before 3.1.0 |
| CVE-2024-23590 | 9.1 | Nov 4 | Session Fixation vulnerability in Apache Kylin Affected: 2.0.0 before 5.0.0 |
| CVE-2022-43396 | 8.8 | Dec 30 | In the fix for CVE-2022-24697, a blacklist is used to filter user input commands Affected: before 4.0.3 |
| CVE-2020-1937 | 8.8 | Feb 24 | Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries Affected: 2.3.0 through 2.3.2; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 2.6.0 through 2.6.4; 3.0.0; 3.0.0; +2 more |
| CVE-2025-61734 | 7.5 | Oct 2 | Files or Directories Accessible to External Parties vulnerability in Apache Kylin Affected: 4.0.0 before 5.0.3 |
| CVE-2025-61733 | 7.5 | Oct 2 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin Affected: 4.0.0 before 5.0.3 |
| CVE-2023-29055 | 7.5 | Jan 29 | In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials Affected: 2.0.0 before 4.0.4 |
| CVE-2021-45458 | 7.5 | Jan 6 | Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords Affected: 2.0.0 through 2.6.6; 3.0.0 before 3.1.3; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-45457 | 7.5 | Jan 6 | In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin Affected: 2.0.0 through 2.6.6; 3.0.0 before 3.1.3; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-27738 | 7.5 | Jan 6 | All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed… Affected: 3.0.0 before 3.1.2 |
| CVE-2025-61735 | 7.3 | Oct 2 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin Affected: 4.0.0 before 5.0.3 |
| CVE-2025-30067 | 7.2 | Mar 27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin Affected: 4.0.0 before 5.0.2 |
| CVE-2024-48944 | 6.5 | Mar 27 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin Affected: 5.0.0 before 5.0.2 |
| CVE-2021-36774 | 6.5 | Jan 6 | Apache Kylin allows users to read data from other database systems using JDBC Affected: 2.0.0 through 2.6.6; 3.0.0 through 3.1.2 |
| CVE-2020-13937 | 5.3 | Oct 19 | Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta,… Affected: 2.0.0; 2.1.0; 2.2.0; 2.3.0; 2.3.1; 2.3.2; +20 more |
| CVE-2026-62393 | 4.3 | Jul 14 | Apache Kylin: Improper authorization in job information retrieval Affected: 4.0.0 before 5.0.4 |
Showing 24