Apache Kylin 5.0.5 fixes 21 CVEs, including critical CVE-2026-64959

What happened

Apache announced 21 Kylin vulnerabilities on 16 October 2026. All are fixed in Apache Kylin 5.0.5. Early press counts of 5 or 12 were partial. Apache's announcements list 21.

The worst is CVE-2026-64959. Apache rates it critical. Certain backend cache API endpoints miss required authentication. That can lead to execution of injected SQL. It affects Kylin 5.0.0 through 5.0.4.

Apache adds a limit. The impact falls most on Kylin services that are directly exposed to a public network. It calls that uncommon and says in-house deployments are mostly not impacted.

What is confirmed

• CVE-2026-64959 is SQL injection (CWE-89) plus missing authentication for a critical function (CWE-306). Credit goes to three finders.
• NVD has no score for it yet. No CVSS score is published as of 19 October 2026.
• Only one of the 21 has an NVD score. CVE-2026-63618 shows CVSS 3.1 7.5 (High), added by CISA ADP. Apache rates it important.
• The other CVEs affect Kylin 4 through 5.0.4, except where noted below.
• None is in the CISA KEV catalog as of 19 October 2026.
• ThreatWire found no public PoC and no report of exploitation.

The 21 CVEs

Severity is Apache's rating. NVD scores are only listed where NVD shows one.

ThreatWire has fiches for CVE-2026-64959 and CVE-2026-63618. The others have none for now.

What is not known

• NVD scores for 20 of the 21. NVD listed only 12 of these CVEs on 18 October, and most were still awaiting analysis.
• Whether any of this is exploited. No source reports attacks.
• How many Kylin servers are exposed to the internet. No scan data was found.
• Apache's wording for CVE-2026-68572 differs from its title. The CVE text says information exposure. The announcement title says unauthorized SQL execution to Spark.

Who should act

• Anyone running Apache Kylin 4 through 5.0.4.
• Teams with Kylin reachable from outside the internal network. They face the most risk, per Apache.
• Teams that run Kylin outside query-only mode. Apache says query-only mode, the default, lowers the impact of the Spark SQL injection.

What to do now

1. Upgrade to Kylin 5.0.5.
2. Do not expose Kylin to the internet. Put backend and API endpoints behind a VPN or an authenticating proxy.
3. Limit who can reach the cache, metadata and job APIs on the network.
4. Check access and application logs for unexpected requests to the cache and metadata APIs, and for odd queries, since 16 October. Look further back if the service was exposed.
5. If you find signs of misuse, rotate credentials stored in Kylin and its data source configurations.

Sources: Apache announcements on oss-security and the Apache mailing list, NVD, CVE.org, CyberStack, OpenCVE.