APACHE has disclosed a set of vulnerabilities across its Kylin, Airflow and related components, with the most severe being a critical SQL injection in Apache Kylin. The overall advisory covers 12 Kylin flaws and three Airflow provider issues, plus notes on Apache Answer. The Kylin flaws affect versions 4.0.0 through 5.0.4, with CVE-2026-64959 specifically impacting 5.0.0 through 5.0.4. Apache states the 5.0.5 release fixes all reported Kylin vulnerabilities.
Airflow is affected by SSH and SFTP provider problems (pre-7.0.0) and a separate Keycloak provider issue (pre-0.11.1); CVEs cited include CVE-2026-94134, CVE-2026-94135 and CVE-2026-96806. Notably, there is no confirmed exploitation in the wild for these Kylin or Airflow flaws at the time of reporting, though one Airflow CVE (CVE-2026-94134) carries a high severity score in some assessments.
In practice, the mitigations are clear: upgrade Apache Kylin to 5.0.5, and isolate Kylin from the public internet or protect it behind a VPN or firewall. For Airflow, upgrade the SSH and SFTP providers to 7.0.0 and the Keycloak provider to 0.11.1, and explicitly configure SSH host keys for Airflow connections. The report also notes that Apache Answer has vulnerability entries under review, though fixed versions were not available at the time.
Organisations should apply these updates promptly, given that several Kylin flaws enable unauthenticated access or code execution via crafted inputs, and that the overall exposure vector includes metadata access and pipeline credential exposure.