Read the docs
TI-2021-14895 Aliases CVE-2021-36774GHSA-5429-pjww-7675

Mysql JDBC Connector Deserialize RCE

Priority LOW 33CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-668, CWE-89 and the CVSS impact.

Summary

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.

Why it matters now

EPSS 0.02013 81st percentileScored 2026-11-07
Fix Fixed org.apache.kylin:kylin (Maven): 3.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache KylinApache Kylin 2 – 2.6.6; Apache Kylin 3 – 3.1.2—No fix listedCNA
—org.apache.kylin:kylin (Maven)before 3.1.33.1.3Patch availableGHSA-5429-pjww-7675
  • Apache Kylin VendorApache Affected Apache Kylin 2 – 2.6.6; Apache Kylin 3 – 3.1.2 Fixed in — No fix listed CNA
  • org.apache.kylin:kylin (Maven) Vendor— Affected before 3.1.3 Fixed in 3.1.3 Patch available GHSA-5429-pjww-7675

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*2.0.0 – 2.6.6; 3.0.0 – 3.1.2VulnerableApache
  • cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.6.6; 3.0.0 – 3.1.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-5429-pjww-7675 org.apache.kylin:kylin (Maven) Fixed in 3.1.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-36774
  2. 2026-10-03 Alias added: GHSA-5429-pjww-7675

References

Advisory 3

Other 2

  • TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
  • TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
  • TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
  • TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences