Apache Kylin: Code injection via special parameter in JDBC URL
Summary
Apache Kylin versions 4.0.0 through 5.0.4 contain a code injection flaw (CWE-94) triggered by a special parameter in a JDBC URL. An attacker with low privileges on a Kylin instance reachable over the network could inject code, and the vendor's CISA SSVC assessment rates the technical impact as total. According to the vendor, the impact falls mainly on Kylin services directly exposed to the public network, while in-house deployments are mostly not affected. The CVSS score of 8.8 was supplied and is not yet confirmed by NVD.
Affected
- Apache Kylin 4.0.0 through 5.0.4
Fixed in
- Apache Kylin 5.0.5
- No backported fix for the 4.x or 5.0.x branches found.
Workaround
- Keep Kylin off the public internet; place it behind a VPN or firewall.
- Restrict Kylin admin and project-admin rights.
- No vendor-confirmed workaround found; these are stopgaps only.
Exploitation
- No exploitation in the wild known.
- No public proof-of-concept known; PSIRT lists no public exploit.
- Recheck CISA KEV and exploit databases before closing.
Our recommendation
- Inventory Kylin deployments; versions 4.0.0 to 5.0.4 are affected.
- Remove direct internet exposure or place Kylin behind a VPN or firewall.
- Review admin accounts and enforce strong authentication.
- Upgrade to 5.0.5 after checking the Apache advisory for additional steps.
- Check JDBC data source configurations for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Kylin vendor advisory thread lists.apache.org
- oss-security post CVE-2026-68571 www.openwall.com
- Strix CVE-2026-68571 www.strix.ai
- ThreatInt CVE-2026-68571 cve.threatint.com
- PSIRT CVE-2026-68571 psirt.com
- SecurityOnline Apache Kylin vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:04.
Original description (NVD)
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.