Threat database

CVE-2026-68572 is a high-severity vulnerability in Apache Kylin that allows exposure of sensitive information to unauthorized actors. It affects Apache Kylin versions from 4.0.0 up to and including 5.0.4. The vulnerability is addressed in version 5.0.5, which users are strongly advised to upgrade to.

CVE-2026-68571 is a high-severity code injection vulnerability in Apache Kylin affecting versions 4.0.0 through 5.0.4. The flaw arises from improper control of code generation via a special parameter in the JDBC URL. This vulnerability mainly impacts Kylin services exposed directly to public networks, which is uncommon, while typical in-house deployments are mostly unaffected. The issue is resolved in Apache Kylin version 5.0.5.

Apache Kylin versions 5.0.0 through 5.0.4 contain a critical SQL Injection vulnerability due to improper neutralization of special elements in SQL commands and missing authentication for a critical backend cache API. This flaw allows unauthenticated attackers to execute injected SQL commands, potentially compromising confidentiality, integrity, and availability. The issue primarily affects Kylin services exposed directly to public networks, which is uncommon in typical in-house deployments. Upgrading to version 5.0.5 resolves the vulnerability.

Apache Kylin versions 4.0.0 through 5.0.4 contain a critical deserialization of untrusted data vulnerability (CWE-502) that arises from unsafe Java deserialization via a broken external cache service. This vulnerability allows remote attackers to execute arbitrary code without authentication. The issue is fixed in Apache Kylin version 5.0.5.

Apache Kylin versions 4.0.0 through 5.0.4 contain a missing authorization vulnerability in a backend metadata dump API. This flaw allows unauthorized access due to insufficient authorization checks and lack of path confinement. The vulnerability primarily impacts Kylin services exposed directly to public networks, which is uncommon, while typical in-house deployments are mostly unaffected. The issue is fixed in version 5.0.5.

Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

CVE-2026-107460 is a critical Server-Side Request Forgery (SSRF) vulnerability in Apache Fesod (Incubating) version 2.0.2-incubating. The vulnerability arises from a DNS rebinding bypass in the UrlImageConverter component, which allows an attacker controlling DNS responses to circumvent hostname validation and access restricted internal addresses. Apache Fesod 2.1.0-incubating mitigates this issue by disabling remote URL image fetching by default and requiring an explicit allowlist for trusted hosts when the feature is enabled. Users are advised to upgrade to version 2.1.0-incubating and restrict allowed hostnames to trusted DNS and HTTP services.

CVE-2026-92120 is a critical authentication bypass vulnerability in Apache Allura affecting versions up to 1.21.0. It involves an OAuth1 request replay attack that allows unauthorized access. The issue is fixed in version 1.22.0, which users are strongly advised to upgrade to.

CVE-2026-92119 is a critical REST API mass assignment vulnerability in Apache Allura affecting versions up to 1.21.0. It allows improper modification of dynamically-determined object attributes. The issue is fixed in version 1.22.0.

CVE-2026-92116 is a critical OAuth1 callback validation vulnerability in Apache Allura up to version 1.21.0. It is an open redirect issue (CWE-601) that allows redirection to untrusted sites. The vulnerability is fixed in Apache Allura version 1.22.0.

CVE-2026-85499 is an improper authorization vulnerability in Apache SkyWalking BanyanDB versions 0.11.0 up to but not including 0.11.1. Under a non-default configuration involving a readonly Canopy user and a reachable monitoring target, this user can send non-read requests through the monitoring proxy, bypassing intended access controls. The issue is fixed in version 0.11.1.

An out-of-bounds read vulnerability exists in the VarOpt union deserialization function of Apache DataSketches C++ versions from 2.0.0-incubating up to 5.2.0. The flaw occurs because the deserialization reads more bytes than available in a truncated serialized union, potentially reading up to 24 bytes past the input end. This can cause a crash (denial of service) and may expose adjacent memory contents. Only applications deserializing VarOpt unions from untrusted sources are affected. The issue is fixed in version 5.3.0.

CVE-2026-103635 is an out-of-bounds read vulnerability in the Apache DataSketches C++ library affecting the compact Theta sketch deserialization process. The vulnerability arises because header fields are read before verifying the input length, allowing crafted or truncated sketches to cause reads past the input end. This can lead to crashes (denial of service) and potential exposure of adjacent memory. The issue affects versions from 3.1.0 up to and including 5.2.0. Upgrading to version 5.3.0 resolves the vulnerability.

CVE-2026-103513 is a critical out-of-bounds read and write vulnerability in the Apache DataSketches C++ library's CPC sketch deserialization. It occurs when a crafted serialized CPC sketch is deserialized, allowing reading past the end of compressed data and writing outside an internal heap buffer due to lack of validation on decoded indices and header fields. This can corrupt heap memory, causing crashes and potentially enabling further exploitation. The issue affects versions from 2.0.0-incubating up to 5.2.0. Upgrading to version 5.3.0 resolves the vulnerability.

A heap-based buffer overflow vulnerability exists in the Apache DataSketches C++ library during deserialization of HLL sketches in LIST mode. The flaw occurs because the coupon count from untrusted input is used to copy entries into a fixed-size buffer of 8 entries without proper bounds checking. This can lead to a write of up to 988 bytes beyond the buffer, corrupting heap memory and potentially causing crashes or further exploitation. The issue affects versions from 1.0.0-incubating up to 5.2.0. Upgrading to version 5.3.0 resolves the vulnerability.

Apache Camel Karavan versions from 4.0.0 up to but not including 4.22.1 contain an improper input validation vulnerability. This flaw allows an authenticated user of any role to deploy arbitrary Kubernetes resources by submitting crafted kubernetes.yaml files without restrictions on resource kinds or security-sensitive pod options. The vulnerability enables the creation of pods with elevated privileges or access to sensitive host resources. The issue is fixed in version 4.22.1.