Apache Kylin (Apache Software Foundation) - vulnerabilities (CVEs)

40 CVEs, 21 in the last 30 days, 2 known versions, newest CVE from 2026-10-19. Vendor: Apache Software Foundation.

CVEs of Apache Kylin

CVE-2026-108837, 2026-10-19: Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe…
CVE-2026-108833, 2026-10-19: Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects…
CVE-2026-108823, 2026-10-19: Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to…
CVE-2026-108780, 2026-10-19: Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public…
CVE-2026-108776, 2026-10-19: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is…
CVE-2026-108771, 2026-10-19: Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are…
CVE-2026-108766, 2026-10-19: Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is…
CVE-2026-108764, 2026-10-19: Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is…
CVE-2026-108762, 2026-10-19: Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which…
CVE-2026-108743 - CVSS 8.8 (high), 2026-10-16: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services…
CVE-2026-108709 - CVSS 9.8 (critical), 2026-10-16: Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not…
CVE-2026-69080 - CVSS 7.5 (high), 2026-10-16: Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are…
CVE-2026-69077 - CVSS 7.5 (high), 2026-10-16: Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public…
CVE-2026-69076 - CVSS 7.5 (high), 2026-10-16: Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network,…
CVE-2026-68573 - CVSS 9.8 (critical), 2026-10-16: Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are…
CVE-2026-68572 - CVSS 7.5 (high), 2026-10-16: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are…
CVE-2026-68571 - CVSS 8.8 (high), 2026-10-16: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact…
CVE-2026-64959 - CVSS 9.8 (critical), 2026-10-16: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache…
CVE-2026-64610 - CVSS 9.8 (critical), 2026-10-16: Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue…
CVE-2026-63619 - CVSS 9.1 (critical), 2026-10-16: Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the…
CVE-2026-63618 - CVSS 7.5 (high), 2026-10-16: Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin:…
CVE-2026-62393 - CVSS 4.3 (medium), 2026-07-14: Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an…
CVE-2026-62392 - CVSS 9.8 (critical), 2026-07-14: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config…
CVE-2026-62390 - CVSS 9.8 (critical), 2026-07-14: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may…
CVE-2025-61735 - CVSS 7.3 (high), 2025-10-02: Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the…
CVE-2025-61734 - CVSS 7.5 (high), 2025-10-02: Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well…
CVE-2025-61733 - CVSS 7.5 (high), 2025-10-02: Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are…
CVE-2025-30067 - CVSS 7.2 (high), 2025-03-27: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin…
CVE-2024-48944 - CVSS 6.5 (medium), 2025-03-27: Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api…
CVE-2024-23590 - CVSS 9.1 (critical), 2024-11-04: Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or…
CVE-2023-29055 - CVSS 7.5 (high), 2024-01-29: In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain…
CVE-2022-44621 - CVSS 9.8 (critical), 2022-12-30: Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
CVE-2022-43396 - CVSS 8.8 (high), 2022-12-30: In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by…
CVE-2022-24697 - CVSS 9.8 (critical), 2022-10-13: Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be…
CVE-2021-36774 - CVSS 6.5 (medium), 2022-01-06: Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated,…
CVE-2021-45458 - CVSS 7.5 (high), 2022-01-06: Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this…
CVE-2021-31522 - CVSS 9.8 (critical), 2022-01-06: Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3…
CVE-2021-45457 - CVSS 7.5 (high), 2022-01-06: In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior…
CVE-2021-45456 - CVSS 9.8 (critical), 2022-01-06: Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what…
CVE-2021-27738 - CVSS 7.5 (high), 2022-01-06: All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security…