CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Published Oct 16, 2026
·Updated
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected Software
1 affected component
Apache Kylin>=4<=5.0.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kylinto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Oct 16, 2026
CVE Published
via MITRE·12:11 PM
Data Sourced
via MITRE·12:11 PM
DescriptionWeakness