CVE-2021-45456: Command Injection in Apache Kylin
Summary
CVE-2021-45456: Command Injection in Apache Kylin. Affects org.apache.kylin:kylin versions < 4.0.1. Fixed in 4.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Kylin is an open-source distributed analytics engine designed to provide SQL interface and multi-dimensional analysis (OLAP) on big data for online analytical processing. It is commonly used for data warehousing and business intelligence applications. However, a vulnerability has been discovered in Apache Kylin version 4.0.0 that allows for command injection.
Vulnerability Detail
The vulnerability in Apache Kylin arises from a mismatch between the legitimacy check performed on the project name and the shell command argument used in the DiagnosisService. This mismatch allows an attacker to pass an illegal project name, leading to command injection. By exploiting this vulnerability, an attacker can execute arbitrary commands with the privileges of the user running the Apache Kylin service. This can result in unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Latest published version: 5.0.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched version of Apache Kylin to mitigate the risk.
Conclusion
The command injection vulnerability in Apache Kylin version 4.0.0 can lead to unauthorized access, data leakage, or compromise of the affected system. It is crucial for users to upgrade to Apache Kylin version 4.0.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
Apache Kylin is an open-source distributed analytics engine designed for big data analysis and online analytical processing (OLAP). It provides a SQL interface and supports multi-dimensional analysis.
This vulnerability allows an attacker to execute arbitrary commands with the privileges of the user running the Apache Kylin service. This can lead to unauthorized access, data leakage, or complete compromise of the affected system.
The vulnerability affects Apache Kylin version 4.0.0. Earlier versions may also be affected, but this has not been confirmed.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the patched version of Apache Kylin.
To fix this vulnerability, you should upgrade your Apache Kylin installation to version 4.0.1 or later. This version includes a fix for the command injection vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
