CVE-2026-64959— Apache Kylin: Missing authentication on certain cache API endpoints
Quick assessment
Affected
Apache Software Foundation Apache Kylin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Kylin 存在“SQL 命令中特殊元素未正确中和（SQL 注入）”以及“关键功能缺少身份验证”的漏洞。该问题主要影响直接暴露于公网的 Kylin 服务（此类部署并不常见），内部部署的 Kylin 实例大多不受影响。 受影响版本为 Apache Kylin 5.0 至 5.0.4。部分后端缓存 API 缺少必要的身份验证机制，可能导致攻击者注入并执行恶意 SQL 语句。 建议用户升级至 5.0.5 版本，该版本已修复此漏洞。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-64959
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Kylin: Missing authentication on certain cache API endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Kylin | 5.0.0 ~ 5.0.4 | - |
|
II. Public POCs for CVE-2026-64959
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-64959
请登录查看更多情报信息。
Other References for CVE-2026-64959 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-16 · 5 CVEs total
| CVE-2026-68571 | Apache Kylin: JDBC URL Whitelist Verification Bypass | |
| CVE-2026-64610 | Apache Kylin: Redis unsafe Java deserialization | |
| CVE-2026-63619 | Apache Kylin: Missing authorization and path-confinement on system meta dump | |
| CVE-2026-63618 | Apache Kylin: Low-Privilege Config Exposure |
IV. Related Vulnerabilities
Same product: Apache Kylin
-
CVE-2026-68571
Apache Kylin: JDBC URL Whitelist Verification Bypass -
CVE-2026-64610
Apache Kylin: Redis unsafe Java deserialization -
CVE-2026-63619
Apache Kylin: Missing authorization and path-confinement on -
CVE-2026-63618
Apache Kylin: Low-Privilege Config Exposure -
CVE-2026-62393
Apache Kylin: Improper authorization in job information retr
Same vendor: Apache Software Foundation
-
CVE-2026-68571
Apache Kylin: JDBC URL Whitelist Verification Bypass -
CVE-2026-64610
Apache Kylin: Redis unsafe Java deserialization -
CVE-2026-63619
Apache Kylin: Missing authorization and path-confinement on -
CVE-2026-63618
Apache Kylin: Low-Privilege Config Exposure -
CVE-2026-94135
Apache Airflow SFTP provider: Async SFTP hook disables host-
Same weakness: CWE-89
-
CVE-2026-111399
WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerabil -
CVE-2026-111472
SQL injection in TSG Profleet -
CVE-2026-92766
Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by -
CVE-2026-94388
WordPress Green Popups plugin < 7.6.3 - SQL Injection vulner -
CVE-2026-111178
WP Booking System <= 2.1.0.1 - Authenticated (Administrator+
V. Comments for CVE-2026-64959
No comments yet