AI analysis
Apache Kylin versions 4 through 5.0.4 have an improper authentication flaw (CWE-287) that lets an unauthenticated user reach system cleanup actions, described in related reporting as unauthenticated metastore cleanup. The issue is triggered by calling those cleanup functions without authenticating, so anyone who can reach an exposed Kylin service can invoke them. That can disrupt or remove metastore and system state rather than granting a documented remote code execution path. Impact is greatest for Kylin services placed directly on the public network, which the vendor says is uncommon; typical in-house deployments are mostly not affected. There is no known public proof of concept, the CVE is not on the CISA KEV list, and exploitation in the wild is not known.
What to do: Upgrade Apache Kylin to 5.0.5 or later. Until then, do not expose Kylin services directly to the public internet, and restrict access to trusted networks and authenticated users only. Review logs for unauthenticated calls to system or metastore cleanup actions.
Affected
| Apache Kylin | 4 through 5.0.4 |
Estimated exposure
nicheunknown; public exposure expected to be uncommon (likely well under 1,000 internet-facing instances) — Apache Kylin is an enterprise OLAP platform usually deployed in-house; the advisory states that direct public-network exposure is uncommon and that most in-house deployments are not impacted, and no public install or internet-scan counts…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.