What is the CVSS score of EUVD-2026-43660?

EUVD-2026-43660 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Apache Kylin are affected by EUVD-2026-43660?

Apache Kylin versions 4 through 5.0.3 contain a critical, unauthenticated SQL injection vulnerability in the table catalog refresh API that enables remote attackers to read, modify, or delete…

How to fix or mitigate EUVD-2026-43660?

Within 24 hours: immediately identify and inventory all systems running Apache Kylin versions 4.x through 5.0.3, then isolate vulnerable instances from production networks or implement firewall rules restricting access to the table catalog refresh API endpoints to trusted internal networks only. Within 7 days: deploy Web Application Firewall rules to detect and block SQL injection payloads targeting the catalog API, enable comprehensive database query logging with alerting on suspicious SQL patterns, and establish a priority escalation channel with Apache Kylin maintainers to track patch release timelines. Within 30 days: execute an upgrade plan to Apache Kylin 5.0.4 or later once patches are released and validated, conduct forensic analysis of API access logs covering the vulnerability exposure period to identify any exploitation attempts, and document all interim controls for security audit trail.

Apache Kylin EUVD-2026-43660

| CVE-2026-62390 CRITICAL

SQL Injection (CWE-89)

2026-07-14

GHSA-92vx-x7gx-68cf

Apache SQLi Kylin

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

SQLi via a backend catalog-refresh API most plausibly requires an authenticated operator session, so PR:L rather than the vendor's PR:N; network vector and full CIA impact retained for injection into backing SQL.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 17:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 17:07 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 17:07 NVD

9.8 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 04:16 vuln.today

CVE Published

Jul 14, 2026 - 03:10 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

SQL injection in Apache Kylin (versions 4 through 5.0.3) allows attackers to inject arbitrary SQL through a backend API used to refresh the table catalog, where untrusted input is concatenated into a dynamically generated SQL statement. The upstream CVSS 3.1 vector rates this as unauthenticated (PR:N) with full confidentiality, integrity, and availability impact (9.8), enabling database read/write and potentially further compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Apache Kylin is a distributed open-source OLAP (Online Analytical Processing) engine for big data, providing sub-second query latency over large datasets via pre-computed cubes, typically layered on Hadoop/Spark/HBase and metadata stores. The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a backend API that refreshes the table catalog builds a SQL statement by concatenating attacker-influenced values (such as table or schema identifiers) instead of using parameterized queries or proper identifier escaping. Because catalog-refresh logic interacts directly with the underlying metadata/data source, injected special elements alter the query the engine executes, breaking out of the intended query structure. CPE cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:* identifies the affected product line, with the fix landing in 5.0.4 (tracked as KYLIN-6089).

RemediationAI

Vendor-released patch: upgrade to Apache Kylin 5.0.4, which fixes the SQL injection per the Apache advisory (https://issues.apache.org/jira/browse/KYLIN-6089 and https://seclists.org/oss-sec/2026/q3/134); this is the primary and recommended action for all deployments running versions 4 through 5.0.3. If an immediate upgrade is not possible, restrict network access to the Kylin backend/administrative API endpoints so the table-catalog refresh function is reachable only from trusted management networks, and place Kylin behind authentication and an access-controlled reverse proxy or firewall rule - the trade-off is that legitimate catalog-refresh automation from other hosts may break and must be allowlisted. Additionally ensure the database account Kylin uses for catalog operations runs with least privilege to limit the blast radius of a successful injection, accepting that overly tight grants can interfere with normal cube-build/metadata operations.