External risk intelligence

Apache Kylin Deserialization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64610

Apache Kylin is an analytics engine typically deployed within internal networks to process data warehouses. While it can be exposed to the internet in specific enterprise configurations to serve API requests, it is not designed as a public-facing edge service or gateway by default, making internet reachability possible but not common.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical vulnerability in Apache Kylin, an analytics engine. The issue involves the unsafe deserialization of data, which could be triggered by a compromised external cache service. If exploited, this vulnerability could allow an attacker to gain significant control over the affected system. The primary concern is to confirm if our environment uses Apache Kylin and if it is exposed to potentially untrusted data sources.

Data handling vulnerability in an analytics tool.
Could lead to unauthorized system access.
Confirm relevance and exposure in our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting a misconfigured or compromised external cache service that Apache Kylin relies on. If this cache service is not properly secured and is accessible, an attacker could manipulate the data it stores, leading to a deserialization of untrusted data within Kylin. This could potentially allow the attacker to execute arbitrary code or gain control over the affected system.

Attacker needs access to an external cache.
Vulnerable component is Java deserialization.
Risk is remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Deserialization of untrusted data in Apache Kylin could allow attackers to execute arbitrary code when an insecure external cache service is used. This vulnerability may impact the integrity and availability of the analytics engine.

System data and service behavior could be affected.
Exposure can occur via a broken external cache service.
Arbitrary code execution may compromise the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Apache Kylin, an analytics engine, has a critical deserialization vulnerability stemming from an external cache service. Identifying and securing instances of Apache Kylin is paramount, especially those exposed externally or handling sensitive data. Initial steps should focus on asset discovery, assessing business criticality, and confirming ownership to prioritize remediation efforts.

Platform or analytics teams own the issue.
Verify external cache service configurations.
Plan upgrade during maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Kylin?

Apache Kylin is an open-source analytics engine used for massive-scale data processing. It provides a multidimensional OLAP interface to interact with large datasets stored in platforms like Hadoop or Spark, helping organizations perform high-speed data analysis.

What does the CVE-2026-64610 deserialization vulnerability mean?

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. It occurs when an application takes data received from an external source and transforms it back into an object without sufficient validation. In this case, an attacker can supply malicious serialized data that the system treats as trusted instructions, potentially leading to full system compromise.

How is this vulnerability triggered?

The flaw is triggered when Apache Kylin processes data from an external cache service that has been compromised or misconfigured. It is important to note that the vulnerability does not trigger through standard, authorized data processing; it requires the interaction with an insecure, external cache component to deliver the malicious payload.

Do I need to worry if my Apache Kylin instance is internal?

According to Halo Surface Signal, Apache Kylin is typically deployed within internal networks and is not designed to be a public-facing edge service. While internal placement reduces the risk of direct, unauthorized access from the internet, you should still evaluate whether any connected cache services are accessible to untrusted parties.

When should I prioritize fixing CVE-2026-64610?

You should prioritize this by first identifying all running instances of Apache Kylin within your environment. Once identified, confirm your current version against the affected range (4 through 5.0.4) and plan an upgrade to version 5.0.5, which contains the necessary security updates to resolve the deserialization flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.