{"schema_version":1,"title":"Apache Kylin vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 23 vulnerabilities in Apache Kylin: 0 in the last 7 days and 21 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-108837, was published on 19 October 2026. 21 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/kylin","json_url":"https://junglewise.ai/threats/technologies/kylin.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/kylin","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":1,"all_time":23,"critical":1,"exploited":1,"last_7_days":0,"last_30_days":21,"last_90_days":21,"last_365_days":22},"latest":[{"cve":"CVE-2026-108837","slug":"cve-2026-108837-allocation-of-resources-without-limits-or-throttling","title":"Apache Kylin resource exhaustion in cache API","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:45.22+00:00","url":"https://junglewise.ai/threats/cve-2026-108837-allocation-of-resources-without-limits-or-throttling"},{"cve":"CVE-2026-108833","slug":"cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin","title":"Apache Kylin default startup profile missing security settings","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:45.123+00:00","url":"https://junglewise.ai/threats/cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin"},{"cve":"CVE-2026-108823","slug":"cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor","title":"Apache Kylin information disclosure in job manipulation","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:45.013+00:00","url":"https://junglewise.ai/threats/cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor"},{"cve":"CVE-2026-108780","slug":"cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in","title":"Apache Kylin JDBC source configuration validation vulnerability","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.913+00:00","url":"https://junglewise.ai/threats/cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in"},{"cve":"CVE-2026-108776","slug":"cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql","title":"Apache Kylin SQL injection in query processing","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.8+00:00","url":"https://junglewise.ai/threats/cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-108771","slug":"cve-2026-108771-missing-authentication-for-in-house-broadcast-and-polymorphic","title":"Apache Kylin missing authentication and polymorphic deserialization","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.69+00:00","url":"https://junglewise.ai/threats/cve-2026-108771-missing-authentication-for-in-house-broadcast-and-polymorphic"},{"cve":"CVE-2026-108766","slug":"cve-2026-108766-missing-authorization-on-jdbc-source-config-update-in-apache","title":"Apache Kylin missing authorization in JDBC source config update","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.587+00:00","url":"https://junglewise.ai/threats/cve-2026-108766-missing-authorization-on-jdbc-source-config-update-in-apache"},{"cve":"CVE-2026-108764","slug":"cve-2026-108764-server-side-request-forgery-ssrf-vulnerability-in-apache-kylin","title":"Apache Kylin server-side request forgery in job service","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.46+00:00","url":"https://junglewise.ai/threats/cve-2026-108764-server-side-request-forgery-ssrf-vulnerability-in-apache-kylin"},{"cve":"CVE-2026-108762","slug":"cve-2026-108762-path-confinement-bypass-during-metadata-backup-deletion-in","title":"Apache Kylin path-confinement bypass in metadata backup deletion","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.313+00:00","url":"https://junglewise.ai/threats/cve-2026-108762-path-confinement-bypass-during-metadata-backup-deletion-in"},{"cve":"CVE-2026-69080","slug":"cve-2026-69080-exposure-of-sql-black-list-to-an-unauthorized-actor-vulnerability","title":"Apache Kylin SQL blacklist exposure to unauthorized user","severity":"info","exploited":false,"published_at":"2026-10-16T20:17:24.56+00:00","url":"https://junglewise.ai/threats/cve-2026-69080-exposure-of-sql-black-list-to-an-unauthorized-actor-vulnerability"},{"cve":"CVE-2026-69077","slug":"cve-2026-69077-exposure-of-unauthorized-cross-project-job-manipulation","title":"Apache Kylin cross-project job manipulation","severity":"info","exploited":false,"published_at":"2026-10-16T20:17:24.45+00:00","url":"https://junglewise.ai/threats/cve-2026-69077-exposure-of-unauthorized-cross-project-job-manipulation"},{"cve":"CVE-2026-69076","slug":"cve-2026-69076-exposure-of-job-discard-to-an-unauthorized-actor-vulnerability-in","title":"Apache Kylin exposure of job discard to unauthorized actor","severity":"info","exploited":false,"published_at":"2026-10-16T20:17:24.343+00:00","url":"https://junglewise.ai/threats/cve-2026-69076-exposure-of-job-discard-to-an-unauthorized-actor-vulnerability-in"},{"cve":"CVE-2026-68573","slug":"cve-2026-68573-improper-authentication-vulnerability-in-apache-kylin","title":"Apache Kylin improper authentication in system cleanup","severity":"info","exploited":false,"published_at":"2026-10-16T20:17:24.233+00:00","url":"https://junglewise.ai/threats/cve-2026-68573-improper-authentication-vulnerability-in-apache-kylin"},{"cve":"CVE-2026-68572","slug":"cve-2026-68572-exposure-of-sensitive-information-to-an-unauthorized-actor","title":"Apache Kylin exposure of sensitive information to unauthorized actor","severity":"info","exploited":false,"published_at":"2026-10-16T20:17:24.12+00:00","url":"https://junglewise.ai/threats/cve-2026-68572-exposure-of-sensitive-information-to-an-unauthorized-actor"},{"cve":"CVE-2026-108743","slug":"cve-2026-108743-improper-neutralization-of-special-elements-used-in-an-os","title":"Apache Kylin OS command injection","severity":"info","exploited":false,"published_at":"2026-10-16T20:17:19.05+00:00","url":"https://junglewise.ai/threats/cve-2026-108743-improper-neutralization-of-special-elements-used-in-an-os"},{"cve":"CVE-2026-108709","slug":"cve-2026-108709-authentication-bypass-within-in-house-network-in-apache-kylin","title":"Apache Kylin authentication bypass in in-house network","severity":"info","exploited":false,"published_at":"2026-10-16T20:17:18.943+00:00","url":"https://junglewise.ai/threats/cve-2026-108709-authentication-bypass-within-in-house-network-in-apache-kylin"},{"cve":"CVE-2026-68571","slug":"cve-2026-68571-improper-control-of-generation-of-code-code-injection","title":"Apache Kylin code injection in JDBC URL parameter","severity":"info","exploited":false,"published_at":"2026-10-16T13:16:57.587+00:00","url":"https://junglewise.ai/threats/cve-2026-68571-improper-control-of-generation-of-code-code-injection"},{"cve":"CVE-2026-64959","slug":"cve-2026-64959-improper-neutralization-of-special-elements-used-in-an-sql","title":"Apache Kylin SQL injection and missing authentication in cache API","severity":"info","exploited":false,"published_at":"2026-10-16T13:16:57.48+00:00","url":"https://junglewise.ai/threats/cve-2026-64959-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-64610","slug":"cve-2026-64610-deserialization-of-untrusted-data-vulnerability-in-apache-kylin","title":"Apache Kylin unsafe deserialization in external cache","severity":"info","exploited":false,"published_at":"2026-10-16T13:16:57.367+00:00","url":"https://junglewise.ai/threats/cve-2026-64610-deserialization-of-untrusted-data-vulnerability-in-apache-kylin"},{"cve":"CVE-2026-63619","slug":"cve-2026-63619-missing-authorization-vulnerability-in-apache-kylin-a-backend","title":"Apache Kylin missing authorization in metadata dump API","severity":"info","exploited":false,"published_at":"2026-10-16T13:16:57.25+00:00","url":"https://junglewise.ai/threats/cve-2026-63619-missing-authorization-vulnerability-in-apache-kylin-a-backend"},{"cve":"CVE-2026-63618","cvss":7.5,"slug":"cve-2026-63618-exposure-of-sensitive-information-system-level-configuration-info","title":"Apache Kylin sensitive information exposure to unauthorized actor","severity":"high","exploited":false,"published_at":"2026-10-16T13:16:57.127+00:00","url":"https://junglewise.ai/threats/cve-2026-63618-exposure-of-sensitive-information-system-level-configuration-info"},{"cve":"CVE-2026-62393","cvss":0,"slug":"cve-2026-62393-apache-kylin-improper-authorization-in-job-information-retrieval","title":"Apache Kylin improper authorization in job information retrieval","severity":"info","exploited":false,"published_at":"2026-07-14T13:19:08.663+00:00","url":"https://junglewise.ai/threats/cve-2026-62393-apache-kylin-improper-authorization-in-job-information-retrieval"},{"cve":"CVE-2020-1956","cvss":3.1,"epss":0.9734,"slug":"cve-2020-1956-apache-kylin-os-command-injection-vulnerability","title":"Command Injection in Kylin","severity":"critical","exploited":true,"published_at":"2020-07-27T22:51:44+00:00","url":"https://junglewise.ai/threats/cve-2020-1956-apache-kylin-os-command-injection-vulnerability"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":12},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":9},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Apache Airflow","slug":"airflow","vulnerabilities":95,"url":"https://junglewise.ai/threats/technologies/airflow"},{"name":"Apache Camel","slug":"camel","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/camel"},{"name":"Apache Tomcat","slug":"tomcat","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/tomcat"},{"name":"Apache Thrift","slug":"thrift","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/thrift"},{"name":"Apache Ofbiz","slug":"ofbiz","vulnerabilities":67,"url":"https://junglewise.ai/threats/technologies/ofbiz"},{"name":"Apache HTTP Server","slug":"http-server","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/http-server"},{"name":"Apache Traffic Server","slug":"traffic-server","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/traffic-server"},{"name":"Apache Brpc","slug":"brpc","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/brpc"},{"name":"Apache Roller","slug":"roller","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/roller"},{"name":"Apache CloudStack","slug":"cloudstack","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/cloudstack"},{"name":"Apache ActiveMQ","slug":"activemq","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/activemq"},{"name":"Apache Apisix","slug":"apisix","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/apisix"}],"technology":{"hub":true,"name":"Apache Kylin","slug":"kylin","vendor":{"hub":true,"name":"Apache","slug":"apache","url":"https://junglewise.ai/threats/vendors/apache"},"aliases":[],"category":"database","homepage":"https://kylin.apache.org/","repo_url":"https://github.com/apache/kylin","description":"Kylin is an open-source distributed analytics engine that provides OLAP capabilities on Hadoop.","url":"https://junglewise.ai/threats/technologies/kylin"},"most_severe":[{"cve":"CVE-2020-1956","cvss":3.1,"epss":0.9734,"slug":"cve-2020-1956-apache-kylin-os-command-injection-vulnerability","title":"Command Injection in Kylin","severity":"critical","exploited":true,"published_at":"2020-07-27T22:51:44+00:00","url":"https://junglewise.ai/threats/cve-2020-1956-apache-kylin-os-command-injection-vulnerability"},{"cve":"CVE-2026-63618","cvss":7.5,"slug":"cve-2026-63618-exposure-of-sensitive-information-system-level-configuration-info","title":"Apache Kylin sensitive information exposure to unauthorized actor","severity":"high","exploited":false,"published_at":"2026-10-16T13:16:57.127+00:00","url":"https://junglewise.ai/threats/cve-2026-63618-exposure-of-sensitive-information-system-level-configuration-info"},{"cve":"CVE-2026-62393","cvss":0,"slug":"cve-2026-62393-apache-kylin-improper-authorization-in-job-information-retrieval","title":"Apache Kylin improper authorization in job information retrieval","severity":"info","exploited":false,"published_at":"2026-07-14T13:19:08.663+00:00","url":"https://junglewise.ai/threats/cve-2026-62393-apache-kylin-improper-authorization-in-job-information-retrieval"},{"cve":"CVE-2026-108837","slug":"cve-2026-108837-allocation-of-resources-without-limits-or-throttling","title":"Apache Kylin resource exhaustion in cache API","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:45.22+00:00","url":"https://junglewise.ai/threats/cve-2026-108837-allocation-of-resources-without-limits-or-throttling"},{"cve":"CVE-2026-108833","slug":"cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin","title":"Apache Kylin default startup profile missing security settings","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:45.123+00:00","url":"https://junglewise.ai/threats/cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin"},{"cve":"CVE-2026-108823","slug":"cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor","title":"Apache Kylin information disclosure in job manipulation","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:45.013+00:00","url":"https://junglewise.ai/threats/cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor"},{"cve":"CVE-2026-108780","slug":"cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in","title":"Apache Kylin JDBC source configuration validation vulnerability","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.913+00:00","url":"https://junglewise.ai/threats/cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in"},{"cve":"CVE-2026-108776","slug":"cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql","title":"Apache Kylin SQL injection in query processing","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.8+00:00","url":"https://junglewise.ai/threats/cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-108771","slug":"cve-2026-108771-missing-authentication-for-in-house-broadcast-and-polymorphic","title":"Apache Kylin missing authentication and polymorphic deserialization","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.69+00:00","url":"https://junglewise.ai/threats/cve-2026-108771-missing-authentication-for-in-house-broadcast-and-polymorphic"},{"cve":"CVE-2026-108766","slug":"cve-2026-108766-missing-authorization-on-jdbc-source-config-update-in-apache","title":"Apache Kylin missing authorization in JDBC source config update","severity":"info","exploited":false,"published_at":"2026-10-19T10:16:44.587+00:00","url":"https://junglewise.ai/threats/cve-2026-108766-missing-authorization-on-jdbc-source-config-update-in-apache"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}