Apache Kylin SQL Injection via Table Catalog Refresh API

Technical Analysis

CVE-2026-62390 is a CWE-89 (SQL Injection) vulnerability in Apache Kylin's backend catalog-refresh API, where user-controllable input is improperly sanitized before being embedded into dynamically generated SQL statements. With a CVSS score of 9.8, this flaw likely allows unauthenticated or low-privilege attackers to inject arbitrary SQL, potentially enabling data exfiltration, privilege escalation, or destructive operations against the underlying OLAP data store. Because Kylin is frequently used as a backend for business intelligence and analytics data that is queried by downstream systems, organizations that feed Kylin query results into RAG pipelines or expose Kylin's API as a tool for AI agents to query analytical data could see poisoned or exfiltrated data propagate into agent context windows, or attackers could pivot from the injected SQL to access credentials/API keys stored in the same database infrastructure that agents rely on.

Affected Systems

Apache Kylin versions 4.0 through 5.0.3; specifically the backend API responsible for refreshing the table catalog. Deployments using this API in production analytics environments are at risk regardless of underlying database engine, since the vulnerability lies in Kylin's SQL generation logic.

Indicators of Compromise

• No specific IOCs published; detection should focus on anomalous SQL patterns in Kylin catalog-refresh API logs and unexpected query errors or schema enumeration attempts.

Remediation Steps

1. 1

   Upgrade Apache Kylin

   Upgrade all affected Apache Kylin instances to version 5.0.4 or later, which contains the official fix for CVE-2026-62390.

2. 2

   Restrict API Access

   Limit network and authentication access to the table catalog refresh API to trusted administrative users and internal networks only.

3. 3

   Audit Logs for Exploitation Attempts

   Review Kylin backend and database logs for unusual SQL syntax, error messages, or catalog refresh requests indicating injection attempts prior to patching.

4. 4

   Database Least Privilege

   Ensure the database account used by Kylin operates with least-privilege permissions to limit blast radius if SQL injection is exploited.

5. 5

   Review Agent/RAG Integrations

   If Kylin query outputs are consumed by AI agents or RAG pipelines, validate and sanitize downstream data ingestion to prevent propagation of injected or manipulated data into agent context.