Apache Kylin SQL Injection via Unauthenticated Backend Cache API (v5.x, <=5.0.4)
CVE-2026-64959 Published on October 16, 2026
Apache Kylin: Missing authentication on certain cache API endpoints
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Vulnerability Analysis
CVE-2026-64959 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Types
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2026-64959 has been classified to as a SQL Injection vulnerability or weakness.
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-64959
Want to know whenever a new CVE is published for Apache Kylin? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Kylin:- Version 5.0.0, <= 5.0.4 is affected.