CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.
Apache disclosed CVE-2026-63619, a moderate missing-authorization flaw in Apache Kylin. A backend system metadata dump API lacks sufficient authorization and path confinement. It affects versions from 4 through 5.0.4, mainly when services are exposed to the public network, which Apache says is uncommon.
- CVE-2026-63619 is rated moderate.
- A metadata dump API lacks sufficient authorization and path confinement.
- Kylin 4 through 5.0.4 is affected.
- Publicly exposed services are most impacted; in-house use usually is not.
Vulnerabilities mentionedAll →
- Missing Authorization in Apache Kylin Metadata Dumppublished · Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63619 | Missing Authorization in Apache Kylin Metadata Dump Apache Kylin versions 4 through 5.0.4 have a missing-authorization flaw (CWE-862) in a backend metadata dump API, which also lacks sufficient path confinement. An attacker who can reach that API may dump system metadata without the authorization the product should enforce. Impact is greatest when Kylin is exposed directly to the public internet, which Apache says is not common; typical in-house deployments are mostly not affected. No CVSS score is available, the issue is not listed in CISA KEV, and no public proof-of-concept is known. Users should upgrade to 5.0.5. Do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services directly to the public internet and restrict access to the backend metadata dump API to trusted administrators. |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4..0.0 through 5.0.4 Description: Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users...
This source does not provide full text. Read it at seclists.org.