You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@kylin.apache.org by Li Yang <li...@apache.org> on 2026/07/14 03:03:43 UTC

CVE-2026-62390: Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API

Severity: important 

Affected versions:

- Apache Kylin 4 through 5.0.3

Description:

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL.

This issue affects Apache Kylin: from 4 through 5.0.3.

Users are recommended to upgrade to version 5.0.4, which fixes the issue.

This issue is being tracked as KYLIN-6089 

Credit:

罗鑫 <lx...@gmail.com> (finder)

References:

https://kylin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-62390
https://issues.apache.org/jira/browse/KYLIN-6089