CVE-2026-62392

HIGH 8.8

Apache Kylin: OS Command Injection via Async Query API

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

CWE	CWE-78
Vendor	apache software foundation
Product	apache kylin
Published	Jul 14, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache kylin

Be the first to know when new high vulnerabilities affecting apache software foundation apache kylin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Kylin

4 ≤ 5.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/9hof8lxo3mzshsh5r77mskzqlkns09gn openwall.com: http://www.openwall.com/lists/oss-security/2026/07/14/5

Credits

Suraj Kattimuttathu Suresh <[email protected]>