Apache disclosed 12 vulnerabilities in Apache Kylin on October 16, one of them a critical SQL injection tracked as CVE-2026-64959. Fixes are available in Kylin 5.0.5, and related advisories cover Apache Airflow’s SSH and SFTP providers and the Apache Answer platform. No exploitation in the wild and no public proof-of-concept have been reported.
CVE-2026-64959: Unauthenticated Cache API Allows SQL Injection in Apache Kylin
Only CVE-2026-64959 is rated critical among the 12 Kylin flaws. A backend cache API lacks required authentication and allows execution of injected SQL. The remaining eleven are rated moderate. They let unauthorized users dump metadata, run cleanup tasks, discard or manipulate jobs, or read system configuration and the SQL blacklist. Several need no login.
Apache says the impact falls mainly on Kylin services that are directly exposed to a public network, which it describes as uncommon. In-house deployments are mostly not impacted. That qualification narrows the likely exposed population, but organizations that placed Kylin behind a public endpoint, even temporarily, have the most reason to upgrade quickly.
Kylin 5.0.5 Is the Fixed Release
Administrators should upgrade Kylin to 5.0.5. Kylin is a data-platform component that often sits in front of sensitive business data and stored credentials, so unauthorized access to metadata or configuration can reveal more than the individual flaw suggests. The disclosed behaviors, from dumping metadata to manipulating jobs, describe an attacker who can both read and disrupt analytics workloads.
Airflow SSH and SFTP Providers Skipped Host-Key Checks by Default
Separate advisories cover Apache Airflow. The SSH and SFTP providers skipped host-key checks by default, tracked as CVE-2026-94134 and CVE-2026-94135. With no host-key verification, a man-in-the-middle attacker could impersonate a server and capture credentials or data.
The severity rating is disputed. CISA scores CVE-2026-94134 at 9.1, while Apache rates it moderate. Teams deciding how fast to apply the Airflow provider updates should note that gap, because workflows that connect to remote hosts over SSH or SFTP routinely carry credentials and bulk data.
A third Airflow issue, CVE-2026-96806, left Keycloak users logged in after logout. Sessions that persist after a user signs out can leave a shared or stolen browser session usable longer than intended.
Apache Answer Entries Lack Official Version Data
Apache Answer also has new database entries for information disclosure, authorization and cross-site scripting issues. Official affected and fixed versions were not available at the time of reporting, so administrators should watch for a fixed release rather than assume the current version is safe.
Patching Priorities for Apache Data Infrastructure
The three products differ in how urgent a response is. Kylin has a clear fixed version and a critical flaw, but Apache’s note about limited public exposure lowers the likelihood of attack for most users. The Airflow bugs depend on whether a deployment relies on the default host-key behavior and whether an attacker can sit on the network path. Apache Answer remains an open item until fixed versions are published.
Rating Disagreements Complicate Triage
The split between CISA’s 9.1 and Apache’s moderate rating for CVE-2026-94134 shows why defenders benefit from reading the mechanism instead of relying on a single score. A missing host-key check does not require an attacker to break anything on the Airflow host itself, but it does require a position on the network between Airflow and the remote server. Organizations that run Airflow across segmented or private networks face lower risk than those that connect to external hosts over the internet.
For all three products, the immediate step is the same: inventory deployments, apply Kylin 5.0.5 and the Airflow provider updates, and monitor Apache’s channels for the Answer fixes.
Teams whose workflows reach external SFTP or SSH servers should apply the Airflow updates on the stricter, CISA reading.
