# Apache Kylin vulnerabilities Source: https://junglewise.ai/threats/technologies/kylin Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/kylin.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 23 vulnerabilities in Apache Kylin: 0 in the last 7 days and 21 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-108837, was published on 19 October 2026. 21 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 21 - Last 90 days: 21 - All time: 23 (1 critical, 1 exploited in the wild) ## About Apache Kylin Kylin is an open-source distributed analytics engine that provides OLAP capabilities on Hadoop. ## Latest Apache Kylin vulnerabilities - [CVE-2026-108837: Apache Kylin resource exhaustion in cache API](https://junglewise.ai/threats/cve-2026-108837-allocation-of-resources-without-limits-or-throttling) (info, published 19 Oct 2026) - [CVE-2026-108833: Apache Kylin default startup profile missing security settings](https://junglewise.ai/threats/cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin) (info, published 19 Oct 2026) - [CVE-2026-108823: Apache Kylin information disclosure in job manipulation](https://junglewise.ai/threats/cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor) (info, published 19 Oct 2026) - [CVE-2026-108780: Apache Kylin JDBC source configuration validation vulnerability](https://junglewise.ai/threats/cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in) (info, published 19 Oct 2026) - [CVE-2026-108776: Apache Kylin SQL injection in query processing](https://junglewise.ai/threats/cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql) (info, published 19 Oct 2026) - [CVE-2026-108771: Apache Kylin missing authentication and polymorphic deserialization](https://junglewise.ai/threats/cve-2026-108771-missing-authentication-for-in-house-broadcast-and-polymorphic) (info, published 19 Oct 2026) - [CVE-2026-108766: Apache Kylin missing authorization in JDBC source config update](https://junglewise.ai/threats/cve-2026-108766-missing-authorization-on-jdbc-source-config-update-in-apache) (info, published 19 Oct 2026) - [CVE-2026-108764: Apache Kylin server-side request forgery in job service](https://junglewise.ai/threats/cve-2026-108764-server-side-request-forgery-ssrf-vulnerability-in-apache-kylin) (info, published 19 Oct 2026) - [CVE-2026-108762: Apache Kylin path-confinement bypass in metadata backup deletion](https://junglewise.ai/threats/cve-2026-108762-path-confinement-bypass-during-metadata-backup-deletion-in) (info, published 19 Oct 2026) - [CVE-2026-69080: Apache Kylin SQL blacklist exposure to unauthorized user](https://junglewise.ai/threats/cve-2026-69080-exposure-of-sql-black-list-to-an-unauthorized-actor-vulnerability) (info, published 16 Oct 2026) - [CVE-2026-69077: Apache Kylin cross-project job manipulation](https://junglewise.ai/threats/cve-2026-69077-exposure-of-unauthorized-cross-project-job-manipulation) (info, published 16 Oct 2026) - [CVE-2026-69076: Apache Kylin exposure of job discard to unauthorized actor](https://junglewise.ai/threats/cve-2026-69076-exposure-of-job-discard-to-an-unauthorized-actor-vulnerability-in) (info, published 16 Oct 2026) - [CVE-2026-68573: Apache Kylin improper authentication in system cleanup](https://junglewise.ai/threats/cve-2026-68573-improper-authentication-vulnerability-in-apache-kylin) (info, published 16 Oct 2026) - [CVE-2026-68572: Apache Kylin exposure of sensitive information to unauthorized actor](https://junglewise.ai/threats/cve-2026-68572-exposure-of-sensitive-information-to-an-unauthorized-actor) (info, published 16 Oct 2026) - [CVE-2026-108743: Apache Kylin OS command injection](https://junglewise.ai/threats/cve-2026-108743-improper-neutralization-of-special-elements-used-in-an-os) (info, published 16 Oct 2026) - [CVE-2026-108709: Apache Kylin authentication bypass in in-house network](https://junglewise.ai/threats/cve-2026-108709-authentication-bypass-within-in-house-network-in-apache-kylin) (info, published 16 Oct 2026) - [CVE-2026-68571: Apache Kylin code injection in JDBC URL parameter](https://junglewise.ai/threats/cve-2026-68571-improper-control-of-generation-of-code-code-injection) (info, published 16 Oct 2026) - [CVE-2026-64959: Apache Kylin SQL injection and missing authentication in cache API](https://junglewise.ai/threats/cve-2026-64959-improper-neutralization-of-special-elements-used-in-an-sql) (info, published 16 Oct 2026) - [CVE-2026-64610: Apache Kylin unsafe deserialization in external cache](https://junglewise.ai/threats/cve-2026-64610-deserialization-of-untrusted-data-vulnerability-in-apache-kylin) (info, published 16 Oct 2026) - [CVE-2026-63619: Apache Kylin missing authorization in metadata dump API](https://junglewise.ai/threats/cve-2026-63619-missing-authorization-vulnerability-in-apache-kylin-a-backend) (info, published 16 Oct 2026) - [CVE-2026-63618: Apache Kylin sensitive information exposure to unauthorized actor](https://junglewise.ai/threats/cve-2026-63618-exposure-of-sensitive-information-system-level-configuration-info) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-62393: Apache Kylin improper authorization in job information retrieval](https://junglewise.ai/threats/cve-2026-62393-apache-kylin-improper-authorization-in-job-information-retrieval) (info, CVSS 0, published 14 Jul 2026) - [CVE-2020-1956: Command Injection in Kylin](https://junglewise.ai/threats/cve-2020-1956-apache-kylin-os-command-injection-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 27 Jul 2020) ## Most severe Apache Kylin vulnerabilities - [CVE-2020-1956: Command Injection in Kylin](https://junglewise.ai/threats/cve-2020-1956-apache-kylin-os-command-injection-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 27 Jul 2020) - [CVE-2026-63618: Apache Kylin sensitive information exposure to unauthorized actor](https://junglewise.ai/threats/cve-2026-63618-exposure-of-sensitive-information-system-level-configuration-info) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-62393: Apache Kylin improper authorization in job information retrieval](https://junglewise.ai/threats/cve-2026-62393-apache-kylin-improper-authorization-in-job-information-retrieval) (info, CVSS 0, published 14 Jul 2026) - [CVE-2026-108837: Apache Kylin resource exhaustion in cache API](https://junglewise.ai/threats/cve-2026-108837-allocation-of-resources-without-limits-or-throttling) (info, published 19 Oct 2026) - [CVE-2026-108833: Apache Kylin default startup profile missing security settings](https://junglewise.ai/threats/cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin) (info, published 19 Oct 2026) - [CVE-2026-108823: Apache Kylin information disclosure in job manipulation](https://junglewise.ai/threats/cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor) (info, published 19 Oct 2026) - [CVE-2026-108780: Apache Kylin JDBC source configuration validation vulnerability](https://junglewise.ai/threats/cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in) (info, published 19 Oct 2026) - [CVE-2026-108776: Apache Kylin SQL injection in query processing](https://junglewise.ai/threats/cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql) (info, published 19 Oct 2026) - [CVE-2026-108771: Apache Kylin missing authentication and polymorphic deserialization](https://junglewise.ai/threats/cve-2026-108771-missing-authentication-for-in-house-broadcast-and-polymorphic) (info, published 19 Oct 2026) - [CVE-2026-108766: Apache Kylin missing authorization in JDBC source config update](https://junglewise.ai/threats/cve-2026-108766-missing-authorization-on-jdbc-source-config-update-in-apache) (info, published 19 Oct 2026) ## Vulnerabilities per week 21 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 12 | 0 | 0 | | 19 Oct 2026 | 9 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Apache technologies - [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities - [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities - [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities - [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities - [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities - [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities - [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities - [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities - [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities - [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities - [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities - [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache Kylin vulnerabilities", https://junglewise.ai/threats/technologies/kylin, 12 November 2026.