CVE-2026-63619
Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in Apache Kylin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-63619
EUVD
EUVD-2026-102852

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Kylin 4..0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a missing authorization vulnerability in Apache Kylin where a backend metadata dump API lacks proper authorization and path-confinement checks. It affects versions 4.0.0 through 5.0.4 and could allow unauthorized access to sensitive system metadata.

Detection Guidance

To detect this vulnerability, check if your Apache Kylin instance is running a vulnerable version (4.0.0 through 5.0.4). Verify if the backend metadata dump API is accessible without proper authorization. Use commands like curl to test API endpoints for unauthorized access. Example: curl -v http://<kylin-server>/kylin/api/metadata/dump. Ensure the response does not expose sensitive metadata without authentication.

Impact Analysis

The impact is most significant for Kylin services directly exposed to public networks, which is uncommon. Most in-house deployments are not affected. If exploited, it could lead to unauthorized access to metadata.

Compliance Impact

The vulnerability could potentially allow unauthorized access to sensitive system metadata if Kylin services are exposed to public networks. This may impact compliance with standards like GDPR or HIPAA if such metadata includes personal or health data. However, the issue primarily affects public-facing deployments, which are uncommon for in-house setups.

Mitigation Strategies
  • Upgrade Apache Kylin to version 5.0.5 or later to address the missing authorization vulnerability in the metadata dump API.
  • Ensure Kylin services are not directly exposed to public networks unless necessary, as this increases the risk of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart