CVE-2020-13925

CVE-2020-13925 Environment Setup Refer to https://github.com/apache/kylin to deploy using Docker, and change the version to 3.0.1 the vulnerable version. You can remove -m 8G \ it controls the allocated memory size. Then visit http://host:7070/kylin/login. The default username and password are...

CVE-2020-13937

Apache Kylin API Unauthorized Access Vulnerability CVE-2020-13937 Fofa:title="Kylin" Usage Help: python3 cve-2020-13937.py --help Single target: python3 cve-2020-13937.py -u http://127.0.0.1 Batch scan: python3 cve-2020-13937.py -f target.txt...

CVE-2026-69077

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Use...

CVE-2026-69076

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are...

CVE-2026-68573

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin...

CVE-2026-69080

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-68572

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-108743

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-108709

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

EUVD-2026-103156

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-108743 Apache Kylin: spark job OS command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-108743

Apache Kylin versions 4.0.4 through 5.0.4 are vulnerable to an OS Command Injection (CWE-78) vulnerability. The root cause is the improper neutralization of special elements used in an OS command, specifically related to spark jobs . This issue primarily impacts Kylin services directly exposed to...

CVE-2026-108709 Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

EUVD-2026-103153

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

CVE-2026-108709

The Apache Kylin project versions 4.0.4 through 5.0.4 are vulnerable to an authentication bypass that allows unauthenticated metadata broadcast within an in-house network. While the impact is most significant for services directly exposed to the public network (which is uncommon), standard in-hou...

EUVD-2026-103152

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-69080

Apache Kylin versions 4 through 5.0.4 are affected by a broken access control vulnerability in the QuerySQLBlacklistController . This flaw allows an unauthorized actor to access the SQL Black List , potentially leading to the exposure of sensitive information (CWE-200). To mitigate this issue, us...

CVE-2026-69080 Apache Kylin: Broken Access Control in QuerySQLBlacklistController

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-69077 Apache Kylin: JobController allows unauthorized cross-project manipulation

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Use...

CVE-2026-69077

Apache Kylin versions 4 through 5.0.4 are vulnerable to an unauthorized cross-project job manipulation vulnerability within the JobController component. This flaw primarily impacts services exposed to the public network, while in-house deployments are generally less affected. The vulnerability is...