CVE-2026-64959
Awaiting Analysis Awaiting Analysis - Queue

SQL Injection in Apache Kylin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-64959
EUVD
EUVD-2026-102854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Kylin 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL Injection vulnerability in Apache Kylin where certain backend cache APIs lack required authentication. Attackers could exploit this by injecting malicious SQL commands, potentially accessing or modifying database contents.

Detection Guidance

To detect this SQL injection vulnerability in Apache Kylin, check if your system is running versions 5 through 5.0.4. Verify if kylin services are exposed to public networks. Inspect logs for unusual SQL queries or authentication bypass attempts.

Impact Analysis

If you run Apache Kylin versions 5 through 5.0.4 exposed to the public internet, attackers could execute unauthorized SQL commands. This could lead to data theft, manipulation, or service disruption. In-house deployments are typically not affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations must address it to maintain compliance.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later to fix the issue. If immediate upgrade is not possible, restrict public access to kylin services and ensure all backend cache APIs require authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart