As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Apache Kylin versions 4.0.0 through 5.0.4 contain a missing authorization and path-confinement vulnerability in a backend metadata dump application programming interface (API). The flaw primarily affects Kylin services exposed directly to public networks, while internal deployments typically face lower risk.
Why it matters: Organizations running publicly exposed Apache Kylin instances should assess whether the affected versions are in use and evaluate exposure of the metadata dump API endpoint.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Apache Kylin versions 4.0.0 through 5.0.4 contain a missing authorization vulnerability in a backend metadata dump application programming interface (API) that fails to enforce proper path confinement. The issue poses the greatest risk to Kylin services exposed directly to public networks, though in-house deployments are typically unaffected. The vulnerability has a CVSS v3.1 score of 9.1.
Why it matters: Organizations running exposed Apache Kylin instances should upgrade immediately to patch this high-severity authorization bypass that could allow unauthorized metadata access.
- Source published
- First seen by Cybersecurity Tracker