https://seclists.org/oss-sec/2026/q4/177: CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Published Oct 16, 2026
·Updated
Affected Software
1 affected component
Apache Kylin>=4.0.0<=5.0.4
Frequently Asked Questions
1
Which deployments are most exposed to this issue?
Apache Kylin services directly exposed to the public network are most affected. The advisory states that in-house Kylin deployments are mostly not impacted.
2
What should teams do to remediate the vulnerability?
Upgrade Apache Kylin to version 5.0.5, which fixes the missing authorization and path-confinement issues.