Missing Authorization in Apache Kylin Metadata Dump
Apache Kylin versions 4 through 5.0.4 have a missing-authorization flaw (CWE-862) in a backend metadata dump API, which also lacks sufficient path confinement. An attacker who can reach that API may dump system metadata without the authorization the product should enforce. Impact is greatest when Kylin is exposed directly to the public internet, which Apache says is not common; typical in-house deployments are mostly not affected. No CVSS score is available, the issue is not listed in CISA KEV, and no public proof-of-concept is known. Users should upgrade to 5.0.5.
What to do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services directly to the public internet and restrict access to the backend metadata dump API to trusted administrators.
| Apache Kylin | 4 through 5.0.4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.
Apache disclosed CVE-2026-63619, a moderate missing-authorization flaw in Apache Kylin. A backend system metadata dump API lacks sufficient authorization and path confinement. It affects versions from 4 through 5.0.4, mainly when services are exposed to the public network, which Apache says is uncommon.