Apache Software Foundation Kylin vulnerabilities

• apache software foundation kylin Apache Kylin: Potential computed-column resource exhaustion CVE-2026-108837 7.5 HighOctober 19, 2026
• apache software foundation kylin Apache Kylin: default startup profile miss security settings CVE-2026-108833 7.5 HighOctober 19, 2026
• apache software foundation kylin Apache Kylin: Potential unauthenticated job metadata replacement CVE-2026-108823 7.5 HighOctober 19, 2026
• apache software foundation kylin Apache Kylin: Potential JDBC source configuration validation issue CVE-2026-108780 6.5 MediumOctober 19, 2026
• apache software foundation kylin Apache Kylin: tables/names SparkSQL injection CVE-2026-108776 5.3 MediumOctober 19, 2026
• apache software foundation kylin Apache Kylin: unauthenticated broadcast API and polymorphic deserialization CVE-2026-108771 9.8 CriticalOctober 19, 2026
• apache software foundation kylin Apache Kylin: missing JDBC-config authorization CVE-2026-108766 6.5 MediumOctober 19, 2026
• apache software foundation kylin Apache Kylin: job-driver UI proxy SSRF CVE-2026-108764 6.5 MediumOctober 19, 2026
• apache software foundation kylin Apache Kylin: delete metadata backup path-confinement bypass CVE-2026-108762 7.3 HighOctober 19, 2026
• apache software foundation kylin Apache Kylin: spark job OS command injection CVE-2026-108743 8.8 HighOctober 16, 2026
• apache software foundation kylin Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) CVE-2026-108709 9.8 CriticalOctober 16, 2026
• apache software foundation kylin Apache Kylin: Broken Access Control in QuerySQLBlacklistController CVE-2026-69080 7.5 HighOctober 16, 2026
• apache software foundation kylin Apache Kylin: JobController allows unauthorized cross-project manipulation CVE-2026-69077 7.5 HighOctober 16, 2026
• apache software foundation kylin Apache Kylin: Unauthorized cross-project job discard CVE-2026-69076 7.5 HighOctober 16, 2026
• apache software foundation kylin Apache Kylin: Unauthenticated Metastore Cleanup CVE-2026-68573 9.8 CriticalOctober 16, 2026
• apache software foundation kylin Apache Kylin: Unauthorized SQL execution to Spark SQL env CVE-2026-68572 7.5 HighOctober 16, 2026
• apache software foundation kylin Apache Kylin: JDBC URL Whitelist Verification Bypass CVE-2026-68571 8.8 HighOctober 16, 2026
• apache software foundation kylin Apache Kylin: Missing authentication on certain cache API endpoints CVE-2026-64959 9.8 CriticalOctober 16, 2026
• apache software foundation kylin Apache Kylin: Redis unsafe Java deserialization CVE-2026-64610 9.8 CriticalOctober 16, 2026
• apache software foundation kylin Apache Kylin: Missing authorization and path-confinement on system meta dump CVE-2026-63619 9.1 CriticalOctober 16, 2026
• apache software foundation kylin Apache Kylin: Low-Privilege Config Exposure CVE-2026-63618 7.5 HighOctober 16, 2026
• apache kylin Apache Kylin: Improper authorization in job information retrieval CVE-2026-62393 4.3 MediumJuly 14, 2026
• apache kylin Apache Kylin: OS Command Injection via Async Query API CVE-2026-62392 9.8 CriticalJuly 14, 2026
• apache kylin Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API CVE-2026-62390 9.8 CriticalJuly 14, 2026
• apache kylin Apache Kylin: Server-Side Request Forgery CVE-2025-61735 Fix available 7.3 HighOctober 2, 2025
• apache kylin Apache Kylin: Authentication bypass CVE-2025-61733 Fix available 7.5 HighOctober 2, 2025
• apache kylin Apache Kylin: improper restriction of file read CVE-2025-61734 Fix available EPSS 28.0% 7.5 HighOctober 2, 2025
• apache kylin Apache Kylin: The remote code execution via jdbc url CVE-2025-30067 Fix available 7.2 HighMarch 27, 2025
• apache kylin Apache Kylin: SSRF vulnerability in the diagnosis api CVE-2024-48944 Fix available 6.5 MediumMarch 27, 2025
• apache kylin Apache Kylin: Session fixation in web interface CVE-2024-23590 Fix available 9.1 CriticalNovember 4, 2024
• apache kylin Apache Kylin: Insufficiently protected credentials in config file CVE-2023-29055 Fix available 7.5 HighJanuary 29, 2024
• apache kylin Apache Kylin: Command injection by Diagnosis Controller CVE-2022-44621 Fix available 9.8 CriticalDecember 30, 2022
• apache kylin Apache Kylin: Command injection by Useless configuration CVE-2022-43396 Fix available EPSS 55.3% 8.8 HighDecember 30, 2022
• apache kylin Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters CVE-2022-24697 Fix available EPSS 84.8% 9.8 CriticalOctober 13, 2022
• apache kylin Hardcoded credentials CVE-2021-45458 Fix available 7.5 HighJanuary 6, 2022
• apache kylin Overly broad CORS configuration CVE-2021-45457 Fix available 7.5 HighJanuary 6, 2022
• apache kylin Command injection CVE-2021-45456 Fix available EPSS 88.9% 9.8 CriticalJanuary 6, 2022
• apache kylin Mysql JDBC Connector Deserialize RCE CVE-2021-36774 Fix available 6.5 MediumJanuary 6, 2022
• apache kylin Apache Kylin unsafe class loading CVE-2021-31522 Fix available 9.8 CriticalJanuary 6, 2022
• apache kylin Improper Access Control to Streaming Coordinator & SSRF CVE-2021-27738 Fix available 7.5 HighJanuary 6, 2022
• apache kylin Authentication bypass in Apache Kylin CVE-2020-13937 Public exploitFix available EPSS 78.3% 5.3 MediumOctober 19, 2020
• apache kylin SQL Injection in Kylin CVE-2020-13926 Fix available 9.8 CriticalJuly 14, 2020
• apache kylin Command Injection in Kylin CVE-2020-13925 Public exploitFix available EPSS 20.0% 9.8 CriticalJuly 14, 2020
• apache kylin SQL Injection in Kylin CVE-2020-1937 Public exploitFix available 8.8 HighFebruary 24, 2020