Apache Kylin EUVD-2026-102854

Exploitation targets a specific backend cache API in Apache Kylin that omits a required authentication check, allowing an unauthenticated request to reach SQL-executing logic (SQL injection). The decisive limiting factor, per the Apache advisory, is network exposure: impact is concentrated on Kylin services directly exposed to the public network, which the vendor states is uncommon, and in-house deployments reachable only from trusted internal networks are mostly not impacted. There is no authentication or user-interaction requirement on the vulnerable endpoint itself, so within a reachable network path, default deployments of Kylin 5 through 5.0.4 are exploitable; the practical gate is whether the instance is reachable by the attacker rather than any special configuration toggle.

No CVSS vector, EPSS score, KEV listing, or POC was provided in the input, so quantitative exploitation signals are entirely absent and cannot be compared - the only severity anchors are the vulnerability class (CWE-89 SQL Injection combined with Missing Authentication for a Critical Function) and the vendor's own narrative. On paper this is a high-severity combination: an unauthenticated backend cache API that permits execution of injected SQL would normally rate near-critical (my independent assessment is CVSS 3.1 9.4, AV:N/AC:L/PR:N/UI:N). However, the Apache advisory explicitly scopes real-world risk downward, stating it impacts mostly Kylin services directly exposed to the public network - which it says is uncommon - and that in-house deployments are mostly not impacted. This is a case where the raw vulnerability class is severe but the realistic blast radius is gated by a deployment condition, so it is a genuine priority ONLY for organizations that expose Kylin to untrusted networks, and a lower priority for typical internal analytics deployments. Exploitation status: no public exploit identified at time of analysis. Note the conflict defenders must resolve: the flaw is unauthenticated and network-reachable (favoring a high score), yet the vendor emphasizes limited exposure (favoring lower operational urgency) - verify your own network exposure before prioritizing.

An attacker who can reach an internet-exposed Apache Kylin instance sends a crafted request to the backend cache API, which fails to enforce authentication, and embeds malicious SQL that the service executes against its backing data store. Because no credentials and no user interaction are required, a single unauthenticated HTTP request to a publicly reachable endpoint is sufficient. No public exploit code was identified at time of analysis.