As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Apache Kylin versions 5.0.0 through 5.0.4 contain a critical vulnerability combining SQL injection and missing authentication on certain cache application programming interface (API) endpoints. The flaw primarily affects Kylin deployments exposed directly to public networks, which is uncommon; internal deployments face lower risk.
Why it matters: Organizations running public-facing Kylin instances need to patch immediately to prevent attackers from bypassing authentication and executing arbitrary SQL commands.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Apache Kylin versions 5.0.0 through 5.0.4 contain a missing authentication vulnerability on certain cache application programming interface (API) endpoints that could enable SQL injection attacks. The issue primarily affects Kylin services exposed directly to public networks, with in-house deployments experiencing limited exposure. The vulnerability carries a CVSS 3.1 score of 9.8.
Why it matters: Organizations running publicly exposed Apache Kylin instances should immediately upgrade beyond version 5.0.4 to prevent unauthenticated attackers from executing arbitrary SQL commands against the cache API.
- Source published
- First seen by Cybersecurity Tracker