Apache Kylin: SQL injection and missing authentication in cache API
Summary
Apache Kylin 5.0.0 through 5.0.4 contains an SQL injection flaw (CWE-89) in a backend cache API that does not require authentication (CWE-306). An unauthenticated attacker who can reach this API can inject SQL commands, with a high impact on confidentiality, integrity and availability (CVSS 3.1 base score 9.8, critical). The risk mainly applies to Kylin services directly exposed to the public internet; in-house deployments are mostly not affected.
Affected
- Apache Kylin 5.0.0 through 5.0.4 (according to the CVE record)
- Default configuration: unaffected (according to the vendor record)
Fixed in
- Apache Kylin 5.0.5
Workaround
- No workaround published by the vendor.
- Until the upgrade, remove public internet exposure of Kylin services or restrict access to VPN or allow-listed networks.
Exploitation
- No exploitation in the wild reported in the sources reviewed (snapshot, may be outdated).
- No public proof-of-concept found in the sources reviewed.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- KEV listing not verified directly.
Our recommendation
- Inventory all Kylin instances, including 4.x and 5.0.x.
- Upgrade affected 5.0.x instances to 5.0.5 and verify the version against the vendor advisory.
- Immediately remove internet exposure of Kylin services or restrict them to VPN or allow-listed networks until patched.
- Review web and access logs for unusual requests to Kylin cache endpoints.
- Check 4.x installations against the advisories of related Kylin CVEs and upgrade them as well.
- Re-check exploitation status (KEV, vendor advisory, PoC trackers) at the next review.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread (vendor advisory) lists.apache.org
- oss-security post CVE-2026-64959 www.openwall.com
- CVE-2026-64959 mirror (CVE record) cve.threatint.com
- Strix CVE-2026-64959 www.strix.ai
- CVE brief CVE-2026-64959 cvebrief.com
- SecurityOnline Apache Kylin vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:41.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.