# CVE-2026-69080: Apache Kylin SQL blacklist exposure to unauthorized user

Source: https://junglewise.ai/threats/cve-2026-69080-exposure-of-sql-black-list-to-an-unauthorized-actor-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-69080 · Severity: info · Published 2026-10-16

Apache Kylin is a big data analytics platform that uses SQL query processing. A vulnerability allows unauthorized users to access the SQL blacklist configuration, which defines restricted queries. This exposure could allow attackers to understand security restrictions and craft queries that evade controls.

Technologies: [Apache Kylin](https://junglewise.ai/threats/technologies/kylin). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-69080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69080 being exploited in the wild.

**How severe is CVE-2026-69080?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** Apache Kylin 4 through 5.0.4.

**Is there a fix for CVE-2026-69080?** Yes: fixed in 5.0.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69080 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69080?** Check whether you run Apache Kylin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.5

## Technical details

A SQL blacklist exposure vulnerability in Apache Kylin allows unauthorized actors to view the SQL blacklist configuration that should be restricted. The issue affects versions 4 through 5.0.4 and requires network access to the Kylin instance. An attacker with unauthenticated or low-privilege access can disclose the blacklist policies used to restrict dangerous queries.

## Affected products

- Apache Kylin 4 through 5.0.4

## Timeline

- 2026-10-16: disclosed

## References

- [https://lists.apache.org/thread.html/zrt6z545y8z9qtsbyzfy55sdpf75osnp](https://lists.apache.org/thread.html/zrt6z545y8z9qtsbyzfy55sdpf75osnp)

## Related threats

- [Apache Kylin resource exhaustion in cache API](https://junglewise.ai/threats/cve-2026-108837-allocation-of-resources-without-limits-or-throttling)
- [Apache Kylin default startup profile missing security settings](https://junglewise.ai/threats/cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin)
- [Apache Kylin information disclosure in job manipulation](https://junglewise.ai/threats/cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor)
- [Apache Kylin JDBC source configuration validation vulnerability](https://junglewise.ai/threats/cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in)
- [Apache Kylin SQL injection in query processing](https://junglewise.ai/threats/cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql)