Apache Kylin discloses two API authorization flaws
Apache Kylin has a moderate metadata-dump flaw through 5.0.4 and a critical unauthenticated cache SQL-injection flaw in 5.0.0–5.0.4.
Apache disclosed two separate Kylin vulnerabilities on 2026-10-16. CVE-2026-63619, rated moderate, is a missing-authorization and path-confinement flaw in a backend system metadata dump API and affects versions from 4 through 5.0.4. CVE-2026-64959, rated critical by Apache, affects 5.0.0 through 5.0.4 and combines missing authentication on certain cache API endpoints with SQL injection. For both issues, Apache says publicly internet-exposed services are most at risk and that such exposure is uncommon, so typical in-house deployments are mostly unaffected. Exploitation of CVE-2026-64959 in the wild is not reported. The reports do not disagree; they cover distinct CVEs.
- Apache disclosed two Apache Kylin flaws on 2026-10-16: CVE-2026-63619 (moderate) and CVE-2026-64959 (critical).
- CVE-2026-63619 is a missing-authorization and path-confinement issue on a backend system metadata dump API, affecting Kylin 4 through 5.0.4.
- CVE-2026-64959 combines missing authentication on certain cache API endpoints with SQL injection, affecting Kylin 5.0.0 through 5.0.4.
- Apache says the greatest impact is when services are exposed to the public internet, which is uncommon; typical in-house deployments are mostly unaffected.
- Exploitation of CVE-2026-64959 in the wild is not reported.
Coverage timelineoldest first · each row is one article
- · 23h agoCVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
oss-security· 42
Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.
- · 23h agoCVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Apache Kylin 5.0.0–5.0.4 cache APIs lack authentication and allow SQL injection.
Vulnerabilities in this storyAll →
- Missing Authorization in Apache Kylin Metadata Dumppublished · Apache Kylin+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-63619+1 related CVE | Missing Authorization in Apache Kylin Metadata Dump Apache Kylin versions 4 through 5.0.4 have a missing-authorization flaw (CWE-862) in a backend metadata dump API, which also lacks sufficient path confinement. An attacker who can reach that API may dump system metadata without the authorization the product should enforce. Impact is greatest when Kylin is exposed directly to the public internet, which Apache says is not common; typical in-house deployments are mostly not affected. No CVSS score is available, the issue is not listed in CISA KEV, and no public proof-of-concept is known. Users should upgrade to 5.0.5. |