CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass

As cited

Copy frozen at 2026-10-16 05:14 UTC (site build).

vulnerabilities

CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass

Apache Kylin versions 4.0.0 through 5.0.4 contain an improper code generation vulnerability that allows code injection through a specially crafted JDBC URL parameter. The issue primarily impacts Kylin services exposed to public networks, while internal deployments face lower risk.

Why it matters: Organizations running Apache Kylin 4.0.0 to 5.0.4 on public-facing systems should prioritize patching to prevent unauthenticated code injection attacks.

Source published

2026-10-16 03:42 UTC

First seen by Cybersecurity Tracker

2026-10-16 04:09 UTC