CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump

Q: Which deployments are most exposed to this issue?

Apache Kylin services directly exposed to the public network are most affected. The available information indicates that in-house Kylin deployments are mostly not impacted.

Q: What versions should be remediated?

Apache Kylin versions from 4 through 5.0.4 are affected. Upgrade to version 5.0.5, which fixes the issue.

Published Oct 16, 2026

Updated

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=4<=5.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Event History

Oct 16, 2026

CVE Published

via MITRE·12:11 PM

Data Sourced

via MITRE·12:11 PM

DescriptionWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Apache Kylin services directly exposed to the public network are most affected. The available information indicates that in-house Kylin deployments are mostly not impacted.

What versions should be remediated?