Apache Kylin EUVD-2026-102855

Exploitation requires the ability to supply or influence a JDBC URL containing the attacker-controlled special parameter used for a datasource/connection in Apache Kylin versions 4 through 5.0.4. Per the vendor, practical risk is largely limited to Kylin services directly exposed to the public network - described as uncommon - while typical in-house (non-public) deployments are mostly not impacted, making network exposure the primary limiting factor. Authentication requirements are not confirmed from available data because no CVSS vector was provided; whether supplying a JDBC URL demands an authenticated/privileged datasource-configuration role versus unauthenticated public access should be verified against the Apache advisory. Upgrading to 5.0.5 removes the condition.

No CVSS vector, EPSS score, KEV listing, or public POC is provided in the input, so quantitative exploitation signals are entirely absent and cannot be cross-referenced - this assessment rests on the vendor description (Apache) and CWE-94 alone. The flaw is a code injection via a special parameter in a JDBC URL, which for a code-injection class (CWE-94) implies server-side arbitrary code execution and therefore high technical impact. The vendor explicitly scopes real-world risk downward: impact is concentrated on Kylin services directly exposed to the public network, which Apache states is uncommon, and typical in-house deployments are described as mostly not impacted. There is no KEV entry (status not confirmed), no EPSS probability to gauge likelihood, and no evidence of public exploit code, so this reads as a high-impact-but-conditional issue rather than a confirmed widespread priority. The key unknown is who can supply the malicious JDBC URL: if datasource/connection configuration requires authentication, exploitation is gated behind privileges; if a public-facing instance accepts attacker-controlled JDBC URLs without auth, risk rises sharply. Verify exposure and authentication requirements against the vendor advisory before prioritizing - raw severity should not be assumed CRITICAL in the absence of a published vector.

An attacker who can reach a Kylin instance exposed to the public network, and who can influence a datasource/connection JDBC URL, supplies a crafted URL containing the malicious special parameter. When Kylin processes the connection string, the injected code is evaluated and executes on the server, yielding remote code execution. No public exploit code is identified at time of analysis, and the vendor notes publicly exposed instances are uncommon.