CVE-2026-68571

8.8High

Published 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-94

Impact

Authenticated attackers with network access can execute arbitrary code on the Kylin service via malicious JDBC URLs. Impact is highest if the instance is exposed directly to the public internet.

Root cause

Improper sanitization of special parameters in the JDBC URL allows code injection.

Affected systems

Apache Kylin 4 through 5.0.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Apache Kylin to version 5.0.5 or later. If patching immediately is not possible, restrict network access so the Kylin service is not reachable from untrusted or public networks.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-68571