CVE-2026-62390: Critical SQL Injection in Apache Kylin

CVE-2026-62390 is a critical (CVSS 9.8) SQL injection in Apache Kylin. A backend API that refreshes the table catalog can inject into the SQL it generates. It affects Kylin 4 through 5.0.3. Apache recommends upgrading to 5.0.4. Restrict network access to the API until you have.

What's affected

• Product: Apache Kylin, from version 4 through 5.0.3.
• Fixed: Apache Kylin 5.0.4, per the Apache announcement.
• Component: the backend API that refreshes the table catalog (Catalog Cache Refresh API). The issue is tracked as KYLIN-6089.
• Weakness: CWE-89, SQL injection. CVSS 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How to check if you're exposed

Find the Kylin version you run. The version is part of the distribution name and of the jar file names under the install directory.

ls $KYLIN_HOME/lib | grep -i kylin | head

Then check who can reach the Kylin web and REST port. A server reachable from user networks or the internet is a bigger concern than one on a locked management network. The free in-browser scan at gold.safeguard.sh/scan covers dependencies in your projects.

What to do now

1. Find every Kylin deployment and note its version.
2. Upgrade to Apache Kylin 5.0.4.
3. Until then, restrict network access to the Kylin API to trusted hosts.
4. Review the database and metadata accounts Kylin uses and cut their rights to what it needs.
5. Check your logs for unusual calls to the catalog refresh endpoint.

Why it matters

SQL injection happens when values from a request are placed into a query as text, so the database cannot tell data from commands. Here the vulnerable path is an internal looking API that builds SQL while refreshing a table catalog. The vector shows the API is reachable over the network with no login and low complexity.

Kylin sits in front of large analytic data, so the impact rating is high across confidentiality, integrity and availability. The record's KEV flag is false, and the announcement does not report attacks.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Apache announcement
• oss-security post

Last reviewed: 19 October 2026.