AK
Product
Apache Kylin
25
CVEs
0
On KEV
9.8
Max CVSS
21
New 30D
Severity mix
Critical 8High 7Medium 1Low 0
Watch
Add Apache Kylin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-108709 | 9.8 | Oct 16 | Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) Affected: 4.0.4 through 5.0.4 |
| CVE-2026-68573 | 9.8 | Oct 16 | Apache Kylin: Unauthenticated Metastore Cleanup Affected: 4.0.0 through 5.0.4 |
| CVE-2026-64959 | 9.8 | Oct 16 | Apache Kylin: Missing authentication on certain cache API endpoints Affected: 5.0.0 through 5.0.4 |
| CVE-2026-64610 | 9.8 | Oct 16 | Apache Kylin: Redis unsafe Java deserialization Affected: 4..0.0 through 5.0.4 |
| CVE-2026-62392 | 9.8 | Jul 14 | Apache Kylin: OS Command Injection via Async Query API Affected: 4 through 5.0.3 |
| CVE-2026-62390 | 9.8 | Jul 14 | Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API Affected: 4 through 5.0.3 |
| CVE-2022-24697 | 9.8 | Oct 13 | Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters Affected: Apache Kylin 2 before 2.6.6; Apache Kylin 3 through 3.1.2; Apache Kylin 4 through 4.0.1 |
| CVE-2026-63619 | 9.1 | Oct 16 | Apache Kylin: Missing authorization and path-confinement on system meta dump Affected: 4..0.0 through 5.0.4 |
| CVE-2026-108743 | 8.8 | Oct 16 | Apache Kylin: spark job OS command injection Affected: 4.0.4 through 5.0.4 |
| CVE-2026-68571 | 8.8 | Oct 16 | Apache Kylin: JDBC URL Whitelist Verification Bypass Affected: 4.0.0 through 5.0.4 |
| CVE-2026-69080 | 7.5 | Oct 16 | Apache Kylin: Broken Access Control in QuerySQLBlacklistController Affected: 4..0.0 through 5.0.4 |
| CVE-2026-69077 | 7.5 | Oct 16 | Apache Kylin: JobController allows unauthorized cross-project manipulation Affected: 4..0.0 through 5.0.4 |
| CVE-2026-69076 | 7.5 | Oct 16 | Apache Kylin: Unauthorized cross-project job discard Affected: 4..0.0 through 5.0.4 |
| CVE-2026-68572 | 7.5 | Oct 16 | Apache Kylin: Unauthorized SQL execution to Spark SQL env Affected: 4..0.0 through 5.0.4 |
| CVE-2026-63618 | 7.5 | Oct 16 | Apache Kylin: Low-Privilege Config Exposure Affected: 4..0.0 through 5.0.4 |
| CVE-2026-62393 | 4.3 | Jul 14 | Apache Kylin: Improper authorization in job information retrieval Affected: 4 through 5.0.3 |
| CVE-2026-108837 | – | Oct 19 | Apache Kylin: Potential computed-column resource exhaustion Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108833 | – | Oct 19 | Apache Kylin: default startup profile miss security settings Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108823 | – | Oct 19 | Apache Kylin: Potential unauthenticated job metadata replacement Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108780 | – | Oct 19 | Apache Kylin: Potential JDBC source configuration validation issue Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108776 | – | Oct 19 | Apache Kylin: tables/names SparkSQL injection Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108771 | – | Oct 19 | Apache Kylin: unauthenticated broadcast API and polymorphic deserialization Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108766 | – | Oct 19 | Apache Kylin: missing JDBC-config authorization Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108764 | – | Oct 19 | Apache Kylin: job-driver UI proxy SSRF Affected: 4.0.0 through 5.0.4 |
| CVE-2026-108762 | – | Oct 19 | Apache Kylin: delete metadata backup path-confinement bypass Affected: 4.0.0 through 5.0.4 |
Showing 25