SQL injection in Apache Kylin - CVE-2026-64959
Published: October 22, 2026
Vulnerability identifier: #VU157251
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64959
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL commands.
The vulnerability exists due to improper neutralization of SQL special elements and missing authentication in certain Apache Kylin backend cache API endpoints when handling requests. A remote attacker can submit requests containing crafted SQL input to execute arbitrary SQL commands.
Affected software
Apache Kylin
How to mitigate CVE-2026-64959
Install security update from vendor's website.
Apache Kylin - update to 5.0.5