← CVE Radar
CVE-2026-62390Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.
9.8 CRITICALEPSS 0.68%Not in KEVNVD: Modified
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-62390
- Status
- Modified
- Assigner (CNA)
- apache
- Published
- Jul 14, 2026
- Last modified
- 2026-10-24 21:10 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
As published by the CNA in the CVE record.
Apache Software FoundationApache Kylin1 version range
- 4 through 5.0.3