CVE-2022-43396: Apache Kylin

High severity, CVSS 8.8. EPSS: 55.3% chance of exploitation in the next 30 days.

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

Affected products

• Apache Kylin: before 4.0.3 (fixed in 4.0.3)

Published 2022-12-30. Last modified 2026-06-17.