Apache published 21 Kylin advisories on Oct 16, all fixed in Kylin 5.0.5. The one Apache rates critical is CVE-2026-64959: certain backend cache API endpoints in Kylin 5.0.0 through 5.0.4 skip authentication and can lead to execution of injected SQL. Apache says the impact is mostly on Kylin services exposed directly to the internet, which it calls uncommon, and that in-house deployments are mostly not affected. The rest of the batch includes Redis unsafe Java deserialization (CVE-2026-64610), Spark job OS command injection (CVE-2026-108743), an unauthenticated broadcast API with polymorphic deserialization (CVE-2026-108771), unauthenticated metastore cleanup (CVE-2026-68573), unauthorized SQL execution in the Spark SQL environment (CVE-2026-68572), SparkSQL injection (CVE-2026-108776), a job-driver UI proxy SSRF (CVE-2026-108764), several cross-project authorization gaps and a default startup profile missing security settings (CVE-2026-108833). Upgrade to 5.0.5 and keep Kylin's API off the internet. No exploitation has been reported.