Loading story…
Apache disclosed CVE-2026-62390, an important-severity SQL injection vulnerability in Apache Kylin affecting versions 4 through 5.0.3. The flaw is in a backend API used to refresh the table catalog cache, where improper neutralization of special elements can allow SQL injection in generated SQL statements.
Apache said the issue is fixed in Apache Kylin 5.0.4 and urged users to upgrade to that release. The vulnerability is tracked internally as KYLIN-6089, and credit for the discovery was given to 罗鑫.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Apache advised users to upgrade to Apache Kylin 5.0.4 to remediate CVE-2026-62390. This indicates version 5.0.4 contains the fix for the SQL injection issue.
Apache disclosed CVE-2026-62390, an important-severity SQL injection vulnerability in Apache Kylin's catalog cache refresh backend API. The flaw affects Apache Kylin versions 4 through 5.0.3 and is tracked internally as KYLIN-6089, with credit given to 罗鑫.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceopenwall.com
Open sourcekylin.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache InLong disclosed **CVE-2026-63038**, an important-severity SQL injection vulnerability caused by unsafe string concatenation in SQL command handling. The flaw affects Apache InLong versions `2.0.0` through before `2.4.0` and allows attackers to inject arbitrary SQL code through the `dbName`, `tableName`, `schemaName`, and `username` parameters. The Apache project advised users to upgrade to **Apache InLong 2.4.0** or cherry-pick the published fix to remediate the issue. The vulnerability was reported by Charles Zhang, and credit for identifying it was given to **zhaokaifei**.
Aug 20, 2026
Apache Syncope disclosed **CVE-2026-57308**, an important SQL injection vulnerability in the Audit Events search functionality that can let an authenticated administrator with sufficient entitlements execute arbitrary SQL through stacked queries. The issue is caused by improper neutralization of special elements in SQL commands, specifically unsanitized `sort` parameters handled by the application. The vulnerability affects Apache Syncope versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.6`, and `4.1.0-M0` through `4.1.1`. Apache advised users to upgrade to **4.0.7** or **4.1.2** to remediate the flaw, and credited **Lennart Hostettler** with reporting the issue.
Jul 20, 2026
Two high-severity SQL injection vulnerabilities were disclosed in **Kysely**, the TypeScript SQL query builder, affecting versions `0.28.12` and `0.28.13` in one case and versions prior to `0.28.14` in another. Both flaws stem from improper handling of backslashes in `DefaultQueryCompiler.sanitizeStringLiteral()`, which escaped single quotes but did not escape backslashes. In MySQL deployments using the default backslash-escape behavior, an attacker could place a backslash before a quote, break out of a string literal or JSON path string, and inject arbitrary SQL. Both issues are tracked as **CWE-89** and carry a **CVSS 3.1** score vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The first issue, **`CVE-2026-33442`**, affects non-type-safe usage of JSON path keys, while **`CVE-2026-33468`** impacts code paths that inline values into compiled SQL strings, including `sql.lit(string)`-style usage and components such as `CreateIndexBuilder.where()` and `CreateViewBuilder.as()` through `ImmediateValueTransformer`. GitHub security advisories were referenced for both disclosures, and the vendor fixed the vulnerabilities in **Kysely `0.28.14`**, making upgrade the primary remediation for affected MySQL-backed applications.
Jun 29, 2026