AI analysis
Apache Kylin versions 4 through 5.0.4 have an unauthorized cross-project job manipulation flaw in JobController, tracked as an exposure of information or actions to an unauthorized actor. It is triggered when a caller who should not control another project can manipulate that project's jobs through the job controller. The impact is greatest for Kylin services reachable directly from the public internet, which the vendor says is uncommon; typical in-house deployments are mostly not affected. Apache recommends upgrading to 5.0.5, which fixes the issue. No public proof of concept is known, and the flaw is not listed in CISA KEV.
What to do: Upgrade Apache Kylin to 5.0.5. Until upgraded, do not expose Kylin services directly to the public internet, and restrict access to job management so only trusted users and networks can reach it. If an instance was internet-reachable, review recent cross-project job changes for unauthorized manipulation.
Affected
| Apache Software Foundation Kylin | 4 through 5.0.4 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.