Apache Kylin & Airflow: Batch of 16 Vulnerabilities Disclosed, Including Injection Flaws
Apache Kylin and Airflow face a batch of 16 disclosed vulnerabilities, including critical injection flaws and authentication bypasses.
Key findings
- 16 CVEs disclosed across Apache Kylin and Airflow between Oct 15-16, 2026.
- Apache Kylin vulnerabilities include SQLi, OS command injection, and unauthorized access flaws.
- Apache Airflow issues involve auth bypass and insecure SSH/SFTP host-key verification.
- Most Kylin vulnerabilities (v4-5.0.4) patched in version 5.0.5.
- Airflow's SSH/SFTP flaws stem from disabled host-key verification by default.
- Kylin instances exposed to public networks face higher risk.
On October 15-16, 2026, a batch of 16 vulnerabilities was disclosed across two Apache projects: Apache Kylin and Apache Airflow. The vulnerabilities in Apache Kylin, numbering 12 in total, span various security flaws including SQL injection, OS command injection, code injection, deserialization of untrusted data, and unauthorized access to sensitive information and system cleanup actions. The Apache Airflow vulnerabilities, four in number, primarily concern authentication bypass, improper host-key verification in SSH/SFTP connections, and overly permissive role assignments. These disclosures highlight potential risks for organizations utilizing these Apache projects, particularly those with Kylin instances exposed to public networks.
The Apache Kylin vulnerabilities present a range of threats. CVE-2026-69080 and CVE-2026-68572 detail an exposure of SQL blacklist and sensitive information, respectively, both affecting versions from 4 through 5.0.4 and patched in 5.0.5. CVE-2026-69077 and CVE-2026-69076 involve unauthorized cross-project job manipulation and job discard, respectively, also impacting versions 4 through 5.0.4. CVE-2026-68573, an improper authentication vulnerability, allows unauthenticated users to access system cleanup actions.
Further compounding the Kylin issues are several injection flaws. CVE-2026-108743 is an OS command injection vulnerability, while CVE-2026-68571 is a code injection flaw exploitable via a special parameter in the JDBC URL. CVE-2026-64959 combines SQL injection with missing authentication for critical functions. Additionally, CVE-2026-64610 involves deserialization of untrusted data from an external cache service, and CVE-2026-63619 is a missing authorization vulnerability in a backend metadata dump API. CVE-2026-108709 addresses an authentication bypass within in-house networks, and CVE-2026-63618 exposes sensitive system-level configuration information. Many of these Kylin vulnerabilities are noted to have the most impact on instances directly exposed to the public network, which is described as uncommon for in-house deployments.
The Apache Airflow vulnerabilities disclosed on October 15, 2026, introduce different security concerns. CVE-2026-96806 describes a session management issue where the Keycloak auth manager did not end the session on logout, allowing users to remain logged in. CVE-2026-94135 and CVE-2026-94134, both related to the SFTP and SSH providers respectively, highlight a critical default setting where SSH host-key verification is disabled, potentially enabling man-in-the-middle attacks. CVE-2026-92228 involves an overly broad permission grant, where the Keycloak provider's multi-team provisioning inadvertently gave all teams global read access to audit logs.
The majority of the Apache Kylin vulnerabilities affecting versions 4 through 5.0.4 are addressed by upgrading to version 5.0.5. For Apache Airflow, specific patches and configuration changes are recommended depending on the affected component and provider. Users are strongly advised to consult the official Apache advisories for detailed mitigation steps and version-specific guidance to protect their deployments from these newly disclosed vulnerabilities.
This batch of disclosures underscores the importance of timely patching and secure configuration, especially for components exposed to external networks. Users of Apache Kylin should prioritize updating to version 5.0.5, while Airflow users need to review their SSH/SFTP configurations and Keycloak integration settings. Staying informed about these disclosures and applying necessary updates is crucial for maintaining the security posture of systems running these Apache projects.
The vulnerabilities were disclosed on October 15-16, 2026, across Apache Kylin and Apache Airflow. The Apache Kylin vulnerabilities include SQL injection, OS command injection, and unauthorized access flaws. Apache Airflow vulnerabilities involve authentication bypass and insecure SSH/SFTP host-key verification. Most Apache Kylin issues affecting versions 4 through 5.0.4 are fixed in version 5.0.5. Users with Kylin instances exposed to public networks are at higher risk. The Airflow SSH/SFTP vulnerabilities stem from disabled host-key verification by default. CVE-2026-69080, CVE-2026-68572, CVE-2026-69077, CVE-2026-69076, CVE-2026-68573, CVE-2026-68572, CVE-2026-108743, CVE-2026-108709, CVE-2026-68571, CVE-2026-64959, CVE-2026-64610, CVE-2026-63619, CVE-2026-63618, CVE-2026-96806, CVE-2026-94135, CVE-2026-94134, CVE-2026-92228.