Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL.

This issue affects Apache Kylin: from 4 through 5.0.3.

Users are recommended to upgrade to version 5.0.4, which fixes the issue.
Published: 2026-07-14
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apache Kylin exposes a backend Catalog Refresh API that improperly sanitizes user input, allowing an attacker to inject arbitrary SQL statements into the database, a classic CWE-89 SQL injection vulnerability. The flaw can lead to unauthorized data disclosure, modification, or deletion, and may enable privileged database operations. The vulnerability is classified as high severity with a CVSS score of 9.8.

Affected Systems

Apache Software Foundation's Apache Kylin versions 4.x up to and including 5.0.3 are affected.

Risk and Exploitability

The CVSS score of 9.8 indicates a severe risk, but the EPSS score of less than 1% suggests a very low probability of exploitation currently. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers would target the Catalog Refresh endpoint over the network, potentially requiring valid credentials or appropriate permissions, but the exact prerequisites are not specified. Based on the description, it is inferred that remote application-level injection through the exposed API is the most likely attack vector.

Generated by OpenCVE AI on July 31, 2026 at 10:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Kylin to version 5.0.4 or later to apply the vendor fix.
  • If an immediate upgrade is not possible, restrict access to the Catalog Refresh API to trusted administrators or internal networks.
  • Monitor application logs for suspicious SQL statements or repeated attempts to refresh catalog tables.
  • Apply additional input validation or sanitization on the Catalog Refresh endpoint to mitigate injection attempts until the patch is deployed.

Generated by OpenCVE AI on July 31, 2026 at 10:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.
Title Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
Weaknesses CWE-89
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-14T16:12:57.844Z

Reserved: 2026-07-14T02:39:25.817Z

Link: CVE-2026-62390

cve-icon Vulnrichment

Updated: 2026-07-14T12:31:54.088Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:45:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')