Loading vulnerability…
SQL Injection in Apache Kylin Catalog Cache Refresh API
CVE-2026-62390 is an SQL injection vulnerability in Apache Kylin versions 4 through 5.0.3. The backend API responsible for refreshing the table catalog cache improperly neutralizes special elements in input incorporated into generated SQL statements. Crafted API requests can alter the intended SQL and enable unauthorized database queries or manipulation. Apache Kylin 5.0.4 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise database confidentiality, integrity, and availability through unauthorized data retrieval, modification, or deletion. Sensitive business intelligence data and analytical information accessible to the affected database connection may be exposed or corrupted. Operating-system command execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
If upgrading must be delayed, restrict access to Apache Kylin APIs to trusted administrative networks and apply WAF protections targeting SQL injection attempts. Monitor catalog cache refresh requests for suspicious SQL syntax and review database logs for anomalous queries. These measures reduce exposure but do not replace the fix; no vulnerability-specific workaround is documented.
Patch, then assume compromise.
Upgrade affected Apache Kylin installations to version 5.0.4 or a later release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.