SB2026102306 - Multiple vulnerabilities in Apache Kylin

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102306

SB2026102306 - Multiple vulnerabilities in Apache Kylin

Published: October 23, 2026

Security Bulletin ID SB2026102306
CSH Severity
High
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 21% Medium 50% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2026-64959)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to improper neutralization of SQL special elements and missing authentication in certain Apache Kylin backend cache API endpoints when handling requests. A remote attacker can submit requests containing crafted SQL input to execute arbitrary SQL commands.


2) Code Injection (CVE-ID: CVE-2026-68571)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject and execute arbitrary code.

The vulnerability exists due to improper control of code generation in Apache Kylin's JDBC URL whitelist verification when processing JDBC URLs containing specially crafted parameters. A remote attacker can supply a JDBC URL with a specially crafted parameter to bypass whitelist verification and inject executable code.


3) Improper Authentication (CVE-ID: CVE-2026-68573)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthorized access to system cleanup actions.

The vulnerability exists due to improper authentication in Apache Kylin's metastore cleanup functionality when handling requests for system cleanup actions. A remote attacker can submit requests without authentication to access cleanup actions that should be restricted.


4) Missing Authentication for Critical Function (CVE-ID: CVE-2026-108709)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and potentially gain unauthorized access to metadata broadcast functionality.

The vulnerability exists due to missing authentication checks in Apache Kylin's metadata broadcast functionality when handling network requests. A remote attacker can send requests without authenticating to potentially access functionality intended to be restricted.

The advisory identifies services directly exposed to public networks as primarily impacted and states that most in-house deployments are not impacted.


5) OS Command Injection (CVE-ID: CVE-2026-108743)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary operating system commands.

The vulnerability exists due to improper neutralization of special elements in Apache Kylin's Spark job handling when incorporating input into operating system commands. A remote attacker can supply specially crafted input to alter the intended command and execute arbitrary operating system commands.


6) Path traversal (CVE-ID: CVE-2026-108762)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass path restrictions and potentially delete files outside the intended metadata backup location.

The vulnerability exists due to improper restriction of file paths in the Apache Kylin metadata backup deletion functionality when processing deletion requests. A remote user can supply a crafted path to potentially cause deletion outside the intended metadata backup location.


7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-108764)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause the server to send requests to unintended destinations, potentially accessing otherwise unreachable resources.

The vulnerability exists due to insufficient validation of request destinations in the Apache Kylin job-driver UI proxy when handling proxy requests. A remote attacker can submit crafted requests to induce server-side requests to unintended destinations, potentially accessing resources reachable from the server.

The advisory identifies job services directly exposed to the public network as the primary exposure scenario and states that in-house deployments are mostly not impacted.


8) Missing Authorization (CVE-ID: CVE-2026-108766)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to make unauthorized changes to JDBC source configuration in Apache Kylin.

The vulnerability exists due to missing authorization in the JDBC source configuration update functionality when handling configuration update requests. A remote user can submit configuration changes without the required authorization checks to modify JDBC source settings without permission.


9) Missing Authentication for Critical Function (CVE-ID: CVE-2026-108771)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access internal broadcast functionality without authentication.

The vulnerability exists due to missing authentication in the Apache Kylin internal broadcast API when handling requests. A remote attacker can send requests without credentials to access functionality intended for internal broadcasts.


10) SQL injection (CVE-ID: CVE-2026-108776)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate SQL queries, potentially enabling unauthorized access to or modification of data.

The vulnerability exists due to improper neutralization of SQL special elements in Apache Kylin's tables/names functionality when processing input for SparkSQL queries. A remote attacker can supply specially crafted input to alter the intended query structure and potentially access or modify data without authorization.

The advisory characterizes the impact as moderate when the Kylin service operates in query-only mode, which is the default and most common mode.


11) Input validation error (CVE-ID: CVE-2026-108780)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass intended validation of JDBC source configurations.

The vulnerability exists due to improper input validation in Apache Kylin's JDBC source configuration handling when processing source configuration values. A remote user can supply crafted configuration values to bypass intended validation checks.


12) Information disclosure (CVE-ID: CVE-2026-108823)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and potentially replace job metadata without authorization.

The vulnerability exists due to insufficient protection of sensitive information in Apache Kylin's job manipulation functionality when handling job metadata operations. A remote attacker can manipulate job metadata without authentication to access sensitive information and potentially replace that metadata.

The impact is described as minor unless job services are exposed to a public network.


13) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-108833)

CWE-ID: CWE-1188 - Insecure Default Initialization of Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially gain unauthorized access to Apache Kylin functionality.

The vulnerability exists due to insecure default initialization in the Apache Kylin startup profile when starting without the security settings profile enabled. A remote attacker can interact with a deployment lacking these security settings to potentially access functionality without the intended security protections.


14) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-108837)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to exhaust computed-column resources and potentially cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Apache Kylin cache API when handling computed-column operations. A remote privileged user can invoke the cache API with project administrator permissions to exhaust computed-column resources and potentially cause a denial of service.


Remediation

Install update from vendor's website.

References