CVE-2026-64959
Apache Kylin missing authentication on backend cache API enables SQL injection
Apache rates CVE-2026-64959 critical. Certain Kylin backend cache API endpoints lack authentication and can run injected SQL. Affects 5.0.0 through 5.0.4. Fixed in 5.0.5. NVD has no score yet. Not in CISA KEV as of check. No exploitation reported.
By ThreatWire Desk · Published 16 Oct 2026 · Updated 19 Oct 2026
- CVSS
- Unknown
- Vector
- Not recorded
- Class
- Auth bypass
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Apache
- Products
- Apache Kylin
- Affected
- Apache Kylin 5.0.0 through 5.0.4.
- Fixed
- Apache Kylin 5.0.5, per the Apache announcement of 16 October 2026.
- Published
- 16 Oct 2026
- Updated
- 19 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-64959 is a critical flaw in Apache Kylin 5.0.0 through 5.0.4. Apache announced it on 16 October 2026 and fixed it in Kylin 5.0.5.
Apache says certain backend cache API endpoints miss required authentication. That can lead to execution of injected SQL. The CVE lists two weaknesses: SQL injection (CWE-89) and missing authentication for a critical function (CWE-306).
Apache rates it critical. NVD has not scored it yet, so no CVSS score is published as of 19 October 2026.
Apache adds that the impact is greatest for Kylin services directly exposed to a public network, which it calls not common. It says in-house deployments are mostly not impacted.
The CVE is not in the CISA KEV catalog as of 19 October 2026. No exploitation and no public PoC have been reported. ThreatWire found none.
What to do: upgrade to Kylin 5.0.5. Keep Kylin backend and API endpoints off the internet.