CVE-2026-62392 is a critical (CVSS 9.8) OS command injection in Apache Kylin. A backend API can pass job config parameters to an operating system command line. It affects Kylin 4 through 5.0.3. Apache recommends upgrading to 5.0.4. Limit network access to the API until then.
What's affected
- Product: Apache Kylin, from version 4 through 5.0.3.
- Fixed: Apache Kylin 5.0.4, per the Apache announcement.
- Component: a backend API that brings job configuration parameters to an OS command line. The Apache post titles it the Async Query API issue, tracked as KYLIN-6091.
- Weakness: CWE-78, OS command injection. CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Find the Kylin version you run. The version is part of the distribution name and of the jar file names under the install directory.
ls $KYLIN_HOME/lib | grep -i kylin | head
Then check who can reach the Kylin web and REST port. A server reachable from user networks or the internet is a bigger concern than one on a locked management network. The free in-browser scan at gold.safeguard.sh/scan covers dependencies in your projects.
What to do now
- Find every Kylin deployment and note its version.
- Upgrade to Apache Kylin 5.0.4.
- Until then, restrict network access to the Kylin API to trusted hosts and block unneeded external exposure.
- Run Kylin under a dedicated low privilege operating system account.
- Review logs for unexpected asynchronous query requests.
Why it matters
Command injection happens when a program builds a shell command line out of values it did not fully control. The record says job configuration parameters reached such a command line. Whoever can call the API may be able to influence what the server runs.
The vector shows network reach, no login and low complexity, which is why the score is 9.8. The record's KEV flag is false, and the Apache post does not describe attacks. Treat it together with CVE-2026-62390, since one upgrade fixes both.
Quick check
What fixes it?
Apache Kylin 5.0.4.
Do I need to patch both Kylin bugs separately?
No. The Apache posts name 5.0.4 as the fix for both CVE-2026-62390 and CVE-2026-62392.
Sources
- Apache announcement (the list page did not load, the oss-security copy did)
- oss-security post
Last reviewed: 19 October 2026.
