Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-62390: Apache Kylin: SQL Injection in Catalog Cache Refresh API

CVE-2026-62390 · published 3 months ago

Summary

Apache Kylin versions 4 through 5.0.3 are at risk of a security threat. An attacker could potentially inject malicious SQL code, which could lead to unauthorized data access or other security issues. To fix this, update to version 5.0.4 or later.

What to do

Update apache kylin to version 5.0.4 or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache kylin	<= 5.0.3
apache	kylin	>= 4.0.0, < 5.0.4 `cpe:2.3:a:apache:kylin::::::::`

Original advisory text

Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL.

This issue affects Apache Kylin: from 4 through 5.0.3.

Users are recommended to upgrade to version 5.0.4, which fixes the issue.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62390... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-62390 Vendor Advisory
https://lists.apache.org/thread/zdrj93txvdjj07f88s43d2pcg2gomvjc Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/14/4 Mailing List Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published14 Jul 2026

Updated4 Nov 2026

First seen14 Jul 2026

Sources

CVE-2026-62390 · NVD

CVE-2026-62390 · MITRE

CVE-2026-62390 · OSV

Track software like this

Free during beta