🚨 CRITICAL: Apache Kylin 5.0.5 fixes 21 CVEs. The worst, CVE-2026-64959, is rated critical by Apache. The exact cause: certain backend cache API endpoints miss required authentication, which can lead to execution of injected SQL. Affects Kylin 5.0.0 through 5.0.4. What Apache says: • Impact is greatest for Kylin services directly exposed to a public network, which it calls uncommon • In-house deployments are mostly not impacted • Fix: upgrade to 5.0.5 What is confirmed as of Oct 19: • 21 CVEs announced Oct 16 • Only CVE-2026-63618 has an NVD score so far: CVSS 3.1 7.5 • Not in CISA KEV • No public PoC and no exploitation reported Do now: upgrade to 5.0.5, keep Kylin API and backend endpoints off the internet, check logs for unexpected requests to the cache and metadata APIs. Full list of all 21 Kylin CVEs with Apache severity, what is confirmed vs unknown, and the checklist: https://www.threatwire.tech/news/apache-kylin-5-0-5-fixes-21-cves-including-critical-cve-2026-64959 #ApacheKylin #CVE #InfoSec #SQLInjection #Apache