Apache Fixes 12 Kylin Flaws, Including Critical SQL Injection, Plus Airflow and Answer Bugs

TL;DR

On October 16, 2026, Apache disclosed 12 Apache Kylin vulnerabilities, including a critical SQL injection flaw, CVE-2026-64959. Version 5.0.5 fixes all of them. Meanwhile, Apache Airflow patched three provider flaws, and Apache Answer users should watch for a fixed release.

Notable CVEs

Why It Matters

Apache Kylin is an analytics engine that runs fast queries over large data sets. It often holds sensitive business data. Several of these bugs need no login at all. Likewise, Airflow schedules data pipelines and stores credentials for many connected systems. Together, the Apache Kylin vulnerabilities and Airflow flaws put core data platforms at risk.

Still, Apache offers some reassurance. In most advisories, it says the impact falls mainly on “kylin services that are directly exposed to public network, which is not common.” It adds that “in-house kylin deployments are mostly not impacted.”

How the Attacks Work

Apache Kylin: one critical flaw

CVE-2026-64959 is the only flaw Apache rates critical. According to the advisory, a backend cache API “misses required authentication and can cause execution of injected SQL.”

Apache Kylin: code and command injection

• CVE-2026-68571: a special parameter in a JDBC URL can lead to code injection. CISA’s assessment rates its technical impact as “total.”
• CVE-2026-108743: OS command injection through Spark jobs.
• CVE-2026-64610: unsafe Java deserialization from a compromised external cache service, such as Redis.

Apache Kylin: access control gaps

The remaining Apache Kylin vulnerabilities are moderate. They let unauthorized users dump metadata, run cleanup tasks, discard or manipulate jobs, or read system configuration and the SQL blacklist.

Apache Airflow: SSH host keys and logout

In Apache Airflow, the SSH and SFTP providers skipped host-key checks by default. As a result, an attacker positioned between Airflow and a server could impersonate that server and capture credentials or data (CVE-2026-94134 and CVE-2026-94135). CISA scores CVE-2026-94134 at 9.1, though Apache rates it moderate. Separately, CVE-2026-96806 left Keycloak users logged in after logout. OX Security and Claude Security Scans are among the credited reporters.

Apache Answer

Apache Answer, a Q&A platform, also has new entries in vulnerability databases. These cover information disclosure, authorization and XSS issues. However, the official affected and fixed versions were not available at the time of writing.

Exploitation status

No source reports exploitation in the wild or a public proof-of-concept. Similarly, CISA lists exploitation as “none” for the Airflow flaws and CVE-2026-68571.

Affected Versions

• Apache Kylin: 4.0.0 through 5.0.4. CVE-2026-64959 affects 5.0.0 through 5.0.4.
• Airflow SSH and SFTP providers: before 7.0.0.
• Airflow Keycloak provider: before 0.11.1.

Patch and Mitigation Steps

• Upgrade Apache Kylin to 5.0.5.
• Keep Kylin off the public internet and behind a VPN or firewall.
• Upgrade the Airflow SSH and SFTP providers to 7.0.0, and the Keycloak provider to 0.11.1.
• Set explicit SSH host keys for Airflow connections.
• Track Apache Answer releases and apply the next security update.

Even internal teams should patch these Apache Kylin vulnerabilities soon, since the critical SQL flaw needs no login.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.