internet-facing-service-vulnerabilitywidely-deployed-product-advisory
Apache Kylin SQL Injection Flaw in Catalog Cache Refresh API
Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Jul 14, 2026
Apache disclosed CVE-2026-62390, an important-severity SQL injection vulnerability in Apache Kylin affecting versions 4 through 5.0.3. The flaw is in a backend API used to refresh the table catalog cache, where improper neutralization of special elements can allow SQL injection in generated SQL statements.
Apache said the issue is fixed in Apache Kylin 5.0.4 and urged users to upgrade to that release. The vulnerability is tracked internally as KYLIN-6089, and credit for the discovery was given to 罗鑫.
Do you run this?See affected versions and whether adversaries are exploiting it.
Check your exposure
