CVE-2026-62390Disclosure(apache / kylin)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache kylin systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kylin

Threat summary

Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
Peaked 3d ago at 4 mentions (2026-07-14); latest day: 1
7 total mentions across 4 days

Affected systems

Vendors

apache

Products

kylin

Deep dive

Activity timeline7 mentions / 4d

Signal classification2 categories

Disclosure

457.1%

Patch

342.9%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	4	Disclosure2Patch2
2026-07-16	1	Disclosure1
2026-07-17	1	Patch1
2026-08-09	1	Disclosure1

Full discourse7 posts

Open Source Security mailing list@oss_security91d
Disclosure
Apache Kylin CVE-2026-62390: SQL Injection in Catalog Cache Refresh API https://openwall.com/lists/oss-security/2026/07/14/4 CVE-2026-62392: OS Command Injection via Async Query API https://www.openwall.com/lists/oss-security/2026/07/14/5 Both "Severity: important" Kylin is a high concurrency, high performance and intelligent OLAP engine
Post summary
The statement announces newly identified CVEs in Apache Kylin, outlining the vulnerability types and severity without providing PoC, exploitation, or remediation details.
11020869
4.7K followersView on X
Orizon@OrizonCyber91d
Patch
🚨 CVE-2026-62390 — CVSS 9.8/10 ██████████ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/5isO3J8EHO
Post summary
The tweet alerts to a critical SQL injection vulnerability (CVE‑2026‑62390) in Apache Kylin, with a CVSS score of 9.8, and urges users to apply the available patch.
10000147
66 followersView on X
takenaka hiroya@Joe_Biden_ja65d
Disclosure
Apache Kylin のテーブルカタログ更新APIにSQLインジェクション。CVSS 9.8で権限不要、4.0.0〜5.0.3が対象、5.0.4で修正。社内分析基盤として内部ネットに置いていて認証を緩めている構成が一番危ないやつです。到達経路も併せて絞ってください。 https://cve.autoarticles.net/cve/CVE-2026-62390
Post summary
The CVE-2026-62390 is a severe SQL injection in Apache Kylin’s table catalog update API, affecting versions 4.0.0‑5.0.3 with no privilege requirement, fixed in 5.0.4.
00000104
562 followersView on X
SecAlerts@SecAlertsCo88d
Patch
💉 Apache Kylin has a critical SQL injection (CVSS 9.8) in the Catalog Cache Refresh API. No auth required, full C/I/A impact. CVE-2026-62390 — patch now if Kylin is in your stack. #ApacheKylin #infosec https://secalerts.co/vulnerability/CVE-2026-62390?utm_campaign=x https://t.co/LcLMr1Jqqg
Post summary
The advisory highlights a critical SQL injection vulnerability in Apache Kylin (CVE‑2026‑62390) and urges users to apply the available patch immediately.
00000145
860 followersView on X
ThreatAft@ThreatAft89d
Disclosure
🚨 Critical Apache Kylin SQLi + Command Injection (CVE-2026-62390 & CVE-2026-62392, CVSS 9.8) Unauth attackers can exfiltrate data and execute arbitrary commands. Upgrade to Kylin 5.0.4 now. 🔗 https://threataft.com/articles/apache-kylin-sql-injection-command-injection-cve-2026-62390-cve-2026-62392?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #ThreatIntel
Post summary
Two critical CVEs (CVE‑2026‑62390 and CVE‑2026‑62392) expose unauthenticated SQL injection and command injection in Apache Kylin, enabling data exfiltration and arbitrary command execution; users are urged to upgrade to Kylin 5.0.4.
00000101
34 followersView on X
Atlas Threat Monitoring@ThreatAtlas91d
Patch
Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-62390 Vendor → Apache Severity → Critical — CVSS 9.8 Product → Kylin Date → 2026-07-14 A critical vulnerability (SQL Injection) has been disclosed affecting Kylin. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Apache
Post summary
A critical SQL injection vulnerability (CVE-2026-62390) affecting Apache Kylin, rated CVSS 9.8, has been disclosed with an immediate patch urged.
00000136
26 followersView on X
Security Arsenal, LLC@SecurityAr5840991d
Disclosure
🔒 #CyberSecurity CVE-2026-62390 & Apache Flaws: Critical SQLi and Auth Bypass Analysis "Over the last 72 hours, the NVD has published three critical vulnerabilities affecting the Apache…" 🔗 https://securityarsenal.com/blog/cve-2026-62390-and-apache-flaws-critical-sqli-and-auth-bypass-analysis #CyberSecurity #ThreatIntel #cve202662390 #critical #cve
Post summary
The tweet announces that NVD has published three critical Apache vulnerabilities, including CVE‑2026‑62390, but provides no PoC, exploitation details, patches, or technical specifics.
0000045
19 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	kylin	-	-	-

Explore more

Back to dashboard apache CVEs kylin vulnerabilities

What researchers are saying

CVE-2026-62390

Orizon[verified]@OrizonCyberPatch

The tweet alerts to a critical SQL injection vulnerability (CVE‑2026‑62390) in Apache Kylin, with a CVSS score of 9.8, and urges users to apply the available patch.

Atlas Threat Monitoring[verified]@ThreatAtlasPatch

A critical SQL injection vulnerability (CVE-2026-62390) affecting Apache Kylin, rated CVSS 9.8, has been disclosed with an immediate patch urged.

Security Arsenal, LLC[verified]@SecurityAr58409Disclosure

The tweet announces that NVD has published three critical Apache vulnerabilities, including CVE‑2026‑62390, but provides no PoC, exploitation details, patches, or technical specifics.

Open Source Security mailing list@oss_securityDisclosure

The statement announces newly identified CVEs in Apache Kylin, outlining the vulnerability types and severity without providing PoC, exploitation, or remediation details.

takenaka hiroya@Joe_Biden_jaDisclosure

The CVE-2026-62390 is a severe SQL injection in Apache Kylin’s table catalog update API, affecting versions 4.0.0‑5.0.3 with no privilege requirement, fixed in 5.0.4.

SecAlerts@SecAlertsCoPatch

The advisory highlights a critical SQL injection vulnerability in Apache Kylin (CVE‑2026‑62390) and urges users to apply the available patch immediately.

ThreatAft@ThreatAftDisclosure

Two critical CVEs (CVE‑2026‑62390 and CVE‑2026‑62392) expose unauthenticated SQL injection and command injection in Apache Kylin, enabling data exfiltration and arbitrary command execution; users are urged to upgrade to Kylin 5.0.4.