- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://kylin.apache.org
Products and areas 11
- Kylin publishes no project-specific security policy. The declared path is the ASF-wide one, with Kylin listed in the foundation's project directory against [email protected], and no scope boundary is stated anywhere, so the whole Kylin tree is in
- The build engine and the job scheduler, covering job submission, job configuration and what a job is permitted to do on the underlying cluster
- The datasource connections to Hive, JDBC sources and streaming inputs, along with the credentials configured for each
- The diagnostic package and log collection endpoints, and what they include about the cluster
- The JDBC driver and any other client the project ships
- The metadata store and every operation that reads or writes it, including how metadata written by one project is isolated from another
- The model and cube definition path, where a definition submitted over the API becomes a build job on the cluster
- The query pushdown path, where a query Kylin cannot answer from a cube is forwarded to an underlying engine
- The query server and its entire REST API, including the administrative, system and diagnostic routes as well as the query endpoints
- The web console and everything reachable from it, including its authentication and session handling
- Users, roles and project-level access control, including how a permission decision is made and cached
Out of scope (6)
- A deployment deliberately published to an untrusted network with default credentials in place, which is a deployment decision
- Anything already covered by one of the six CVEs published in the past year
- Findings against releases the project no longer ships
- Hadoop, Hive, Spark, HBase and the other cluster components Kylin runs on, where Kylin is only the client
- Resource exhaustion from a cube build the operator sized the cluster for
- Upstream dependency vulnerabilities, unless Kylin's own use of the dependency makes them reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Report privately to the address on the policy page , Kylin's listed contact in the ASF project directory, naming Kylin clearly in the subject
-
Do not open a public GitHub issue or pull request describing the vulnerability before the fixed release ships
-
Check the recent CVEs before reporting.
-
Name the release you tested.
-
Include the HTTP request or the cube or model definition that triggers it, and state what credentials the request carried
Not accepted
-
Upstream dependency vulnerabilities, unless Kylin's own use of the dependency makes them reachable
-
Findings against releases the project no longer ships
-
Anything already covered by one of the six CVEs published in the past year
-
Resource exhaustion from a cube build the operator sized the cluster for
-
A deployment deliberately published to an untrusted network with default credentials in place
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-97355 | Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-97356 | External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-82960 | Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because th | High 8.8 | 5 Nov 2026 |
| CVE-2026-83538 | Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no p | Medium 5.3 | 5 Nov 2026 |
| CVE-2026-83542 | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-84183 | Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CR | High 8.8 | 5 Nov 2026 |
| CVE-2026-84728 | Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostn | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-85627 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no | High 8.8 | 5 Nov 2026 |
| CVE-2026-92887 | Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of th | High 7.3 | 5 Nov 2026 |
| CVE-2026-82904 | Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by mu | High 7.5 | 5 Nov 2026 |
| CVE-2026-82907 | Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-82910 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute | High 8.8 | 5 Nov 2026 |
| CVE-2026-82912 | Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the | High 8.8 | 5 Nov 2026 |
| CVE-2026-82916 | Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassw | High 7.1 | 5 Nov 2026 |
| CVE-2026-82902 | Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supply | Medium 4.3 | 5 Nov 2026 |
| CVE-2026-114233 | Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShi | High 8.1 | 5 Nov 2026 |
| CVE-2026-114235 | Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114271 | Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other part | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114272 | Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommend | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114277 | Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109129 | Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via the updateOrderPaymentPreference service, by supplying an orderPaymentPreferenceId belonging to a differ | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109837 | Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109856 | Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, creat | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109928 | Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative | High 7.4 | 5 Nov 2026 |
| CVE-2026-114229 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade | Medium 6.1 | 5 Nov 2026 |
| CVE-2026-59267 | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.8 | 4 Nov 2026 |
| CVE-2026-90631 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes | Low 3.3 | 4 Nov 2026 |
| CVE-2026-90632 | Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90634 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90624 | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90626 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90627 | The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90628 | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90629 | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59264 | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.8 | 4 Nov 2026 |
| CVE-2026-59268 | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59263 | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Low 1.9 | 4 Nov 2026 |
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to vers | Critical 9.8 | 30 Oct 2026 |
| CVE-2026-65874 | This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existin | High 8.8 | 30 Oct 2026 |
| CVE-2026-95628 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose f | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95629 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling tool in CLI mode, the default, and tells it where to write the converted document through the --output flag. When the CamelDoclingOutputFilePat | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95663 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection | Medium 4.8 | 26 Oct 2026 |
| CVE-2026-95664 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-101259 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Intern | Medium 5.3 | 26 Oct 2026 |
| CVE-2026-111497 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie | Critical 9.2 | 22 Oct 2026 |
| CVE-2026-88900 | Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an Objec | High 8.8 | 19 Oct 2026 |
| CVE-2026-85313 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that let | Medium 4.3 | 19 Oct 2026 |
| CVE-2026-85314 | Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange w | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85315 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the status cause, which stays local to the server, the description is transmitted to th | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85316 | Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rather than by matching the path exactly. Any endpoint whose path merely begins with t | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85317 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token w | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85254 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by va | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85257 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client in the fault: CXF copies the message into the SOAP f | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85260 | Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the | Medium 5.5 | 19 Oct 2026 |
| CVE-2026-85296 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85312 | Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85247 | Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on | Medium 5.9 | 19 Oct 2026 |
| CVE-2026-85249 | Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is attacker-controlled content: the party that supplies the file chooses the metadata ke | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85250 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default documen | High 7.5 | 19 Oct 2026 |
| CVE-2026-85251 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequ | High 7.5 | 19 Oct 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 6 Last 12 months Auth/access control 35 % Remote code execution 30 % Info disclosure 20 % Input validation 15 % Latest advisories Loading the feed Overview Apache Kylin is an OLAP cube engine that pre-computes aggregates over Hadoop data so BI tools get sub-second answers, and it retains a real installed base in Chinese enterprise reporting. Development has slowed, though the project is live and outside the Attic. What stands out is the CVE density: six landed in the past year, two of them critical, against a project of modest size. Researchers are clearly working this target and none of them was paid for it. The Apache Software Foundation states that as a volunteer organisation it runs no bug bounty, and Kylin appears on no bounty platform. sorona.xyz pays you directly on qualified, reproduced findings. In scope Kylin publishes no project-specific security policy. The declared path is the ASF-wide one, with Kylin listed in the foundation's project directory against [email protected] , and no scope boundary is stated anywhere, so the whole Kylin tree is in The query server and its entire REST API, including the administrative, system and diagnostic routes as well as the query endpoints The web console and everything reachable from it, including its authentication and session handling The model and cube definition path, where a definition submitted over the API becomes a build job on the cluster The build engine and the job scheduler, covering job submission, job configuration and what a job is permitted to do on the underlying cluster The metadata store and every operation that reads or writes it, including how metadata written by one project is isolated from another Users, roles and project-level access control, including how a permission decision is made and cached The datasource connections to Hive, JDBC sources and streaming inputs, along with the credentials configured for each The query pushdown path, where a query Kylin cannot answer from a cube is forwarded to an underlying engine The JDBC driver and any other client the project ships The diagnostic package and log collection endpoints, and what they include about the cluster Out of scope Hadoop, Hive, Spark, HBase and the other cluster components Kylin runs on, where Kylin is only the client A deployment deliberately published to an untrusted network with default credentials in place, which is a deployment decision Upstream dependency vulnerabilities, unless Kylin's own use of the dependency makes them reachable Findings against releases the project no longer ships Anything already covered by one of the six CVEs published in the past year Resource exhaustion from a cube build the operator sized the cluster for Most-valued findings Anything reachable on the REST API without valid credentials, or with credentials that should not reach that route. The two criticals in the window, CVE-2026-62390 and CVE-2026-62392, mark the top of the published record Parameters that reach a shell, a job specification or a cluster command. A cube build is a Hadoop job assembled from a definition a user supplied, and that assembly step is the highest-value seam in the codebase The class the three highs of the window landed in, CVE-2025-61733, CVE-2025-61734 and CVE-2025-61735, which mark where the current wave of research is already productive Recovery of the credentials held for datasources and for the underlying cluster from configuration, from the metadata store or from a diagnostic package Project-level access control bypass, where a user of one project reads cubes or query results belonging to another Deserialisation of metadata or job state into object construction, a recurring shape in JVM data platforms of this generation Server-side request forgery from any endpoint that takes a datasource URL or fetches on the caller's behalf Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , Kylin's listed contact in the ASF project directory, naming Kylin clearly in the subject There is no money at any severity. The ASF runs no bug bounty as a foundation-wide position and no vendor pays for Kylin findings either Do not open a public GitHub issue or pull request describing the vulnerability before the fixed release ships Check the recent CVEs before reporting. Six landed in the past year and the surface is being actively worked, so duplication is a real risk here in a way it is not on quieter targets Name the release you tested. Development is slower than it once was, and a finding only counts if it reproduces against a version the project still ships Include the HTTP request or the cube or model definition that triggers it, and state what credentials the request carried Disclosure Handled under the ASF process: a private report to the security team, an embargoed fix agreed with the maintainers, then a public advisory and a CVE alongside the release carrying the fix. Kylin publishes through the ASF and NVD rather than as GitHub advisories. Release cadence is modest, so expect the embargo to run longer than on a fast-moving project, and hold the detail until the announcement. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability