Technology · Apache
Apache Kylin vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 23 vulnerabilities in Apache Kylin: 0 in the last 7 days and 21 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-108837, was published on 19 October 2026. 21 vulnerabilities in the last four weeks, up from none in the four before.
- Last 7 days
- 0
- Last 90 days
- 21
- Critical, all time
- 1
- Exploited in the wild
- 1
About Apache Kylin
Kylin is an open-source distributed analytics engine that provides OLAP capabilities on Hadoop.
Latest Apache Kylin vulnerabilities
- CVE-2026-108837: Apache Kylin resource exhaustion in cache APIinfo
- CVE-2026-108833: Apache Kylin default startup profile missing security settingsinfo
- CVE-2026-108823: Apache Kylin information disclosure in job manipulationinfo
- CVE-2026-108780: Apache Kylin JDBC source configuration validation vulnerabilityinfo
- CVE-2026-108776: Apache Kylin SQL injection in query processinginfo
- CVE-2026-108771: Apache Kylin missing authentication and polymorphic deserializationinfo
- CVE-2026-108766: Apache Kylin missing authorization in JDBC source config updateinfo
- CVE-2026-108764: Apache Kylin server-side request forgery in job serviceinfo
- CVE-2026-108762: Apache Kylin path-confinement bypass in metadata backup deletioninfo
- CVE-2026-69080: Apache Kylin SQL blacklist exposure to unauthorized userinfo
- CVE-2026-69077: Apache Kylin cross-project job manipulationinfo
- CVE-2026-69076: Apache Kylin exposure of job discard to unauthorized actorinfo
- CVE-2026-68573: Apache Kylin improper authentication in system cleanupinfo
- CVE-2026-68572: Apache Kylin exposure of sensitive information to unauthorized actorinfo
- CVE-2026-108743: Apache Kylin OS command injectioninfo
- CVE-2026-108709: Apache Kylin authentication bypass in in-house networkinfo
- CVE-2026-68571: Apache Kylin code injection in JDBC URL parameterinfo
- CVE-2026-64959: Apache Kylin SQL injection and missing authentication in cache APIinfo
- CVE-2026-64610: Apache Kylin unsafe deserialization in external cacheinfo
- CVE-2026-63619: Apache Kylin missing authorization in metadata dump APIinfo
- CVE-2026-63618: Apache Kylin sensitive information exposure to unauthorized actorhighCVSS 7.5
- CVE-2026-62393: Apache Kylin improper authorization in job information retrievalinfoCVSS 0
- CVE-2020-1956: Command Injection in Kylincriticalexploited in the wildCVSS 3.1EPSS 97.3%
Most severe Apache Kylin vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2020-1956: Command Injection in Kylincriticalexploited in the wildCVSS 3.1EPSS 97.3%
- CVE-2026-63618: Apache Kylin sensitive information exposure to unauthorized actorhighCVSS 7.5
- CVE-2026-62393: Apache Kylin improper authorization in job information retrievalinfoCVSS 0
- CVE-2026-108837: Apache Kylin resource exhaustion in cache APIinfo
- CVE-2026-108833: Apache Kylin default startup profile missing security settingsinfo
- CVE-2026-108823: Apache Kylin information disclosure in job manipulationinfo
- CVE-2026-108780: Apache Kylin JDBC source configuration validation vulnerabilityinfo
- CVE-2026-108776: Apache Kylin SQL injection in query processinginfo
- CVE-2026-108771: Apache Kylin missing authentication and polymorphic deserializationinfo
- CVE-2026-108766: Apache Kylin missing authorization in JDBC source config updateinfo
Vulnerabilities per week
21 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 12 | 0 | |
| 19 Oct 2026 | 9 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache Kylin vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/kylin)<a href="https://junglewise.ai/threats/technologies/kylin"><img src="https://junglewise.ai/threats/technologies/kylin/badge.svg" alt="Apache Kylin vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/kylin.json, and this page as text at https://junglewise.ai/threats/technologies/kylin.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache Kylin vulnerabilities", https://junglewise.ai/threats/technologies/kylin, 12 November 2026.