{"id":"CVE-2026-63619","kind":"vulnerability","aliases":["CVE-2026-63619"],"related":[],"title":"Missing Authorization vulnerability in Apache Kylin","description":"Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin 4.0.0 through 5.0.4 has a backend system metadata dump API with insufficient authorization and no path confinement. Apache says the impact is mostly on Kylin services exposed directly to a public network, and in-house deployments are mostly not affected. The advisory does not name the endpoint or list the metadata exposed. Tracked as KYLIN-6093 and KYLIN-6102. Credit: George Chen, n0mi1k Security, MopMonk-AI. Part of a batch of about 20 Kylin CVEs published 2026-10-16, so upgrade once.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Kylin","fixed":["5.0.5"],"affected":">= 4.0.0, <= 5.0.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["apache-kylin","big-data","missing-authorization","package","path-traversal","self-hosted"],"not_affected_if":["in-house-only-network","internal-network-only","kylin-version-5.0.5-or-later","not-internet-exposed"],"how_to_check":"Run 'kylin.sh version' or look at the Kylin jar or release version: 4.0.0 through 5.0.4 is affected. Then check whether the Kylin HTTP port (7070 by default) is reachable from the internet or an untrusted network. The specific endpoint is not published, so unknown.","fix":"Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin to the public internet; restrict it with a firewall or reverse-proxy allowlist.","status":"open","published_at":"2026-10-16T13:16:57+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:15:06+00:00","updated_at":"2026-10-23T23:33:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:15:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Kylin to version 5.0.5.","reach":"internet","impact":"medium","summary":"Apache Kylin versions 4 through 5.0.4 have a backend metadata dump API that lacks sufficient authorization and path confinement. An attacker who can reach the API can dump Kylin metadata from the server.","category":"package","who_cares":["apache-kylin","big-data","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads server metadata files through an unauthenticated dump endpoint","analyst_note":"Confirm from the Apache Kylin security advisory whether the metadata dump API requires any auth, which endpoint is affected, and what metadata is exposed; the NVD entry alone does not say.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["in-house-only-network","kylin-version-5.0.5-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000462,"input_tokens":2808,"output_tokens":363,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm from the Apache Kylin security advisory whether the metadata dump API requires any auth, which endpoint is affected, and what metadata is exposed; the NVD entry alone does not say.","search":"'-10':112B '-16':113B '-2026':8A,11A '-6093':89B '-6102':92B '-63619':9A,12A '20':107B '2026':111B '4':168C '4.0.0':33B '5.0.4':35B,170C '5.0.5':178C 'advisori':75B 'affect':73B,164C 'ai':100B 'apach':5A,16B,31B,50B,120C,165C 'apache':13A 'apache-kylin':15B 'api':42B,126C 'author':2A,23B,45B,117C,130C 'backend':38B,123C 'batch':104B 'big':19B 'big-data':18B 'chen':95B 'common':152C 'confin':49B,135C 'credit':93B 'cve':7A,10A 'cves':109B 'data':20B 'deploy':69B,157C 'direct':60B,144C 'dump':41B,125C 'endpoint':80B 'enough':129C 'expos':59B,85B,145C 'fix':180C 'georg':94B 'host':30B 'hous':68B,155C 'impact':53B,136C,161C 'in-hous':66B,153C 'insuffici':44B 'issu':163C,182C 'kylin':6A,14A,17B,32B,57B,88B,91B,108B,121C,140C,156C,166C 'list':82B 'metadata':40B,84B,124C 'miss':1A,22B,116C,127C 'missing-author':21B 'mopmonk':99B 'mopmonk-ai':98B 'most':55B,71B,159C 'n0mi1k':96B 'name':78B 'network':64B,148C 'packag':24B 'part':101B 'path':26B,48B,134C 'path-confin':133C 'path-travers':25B 'public':63B,147C 'publish':110B 'recommend':173C 'say':51B 'secur':97B 'self':29B 'self-host':28B 'servic':58B,141C 'system':39B 'track':86B 'travers':27B 'upgrad':115B,175C 'user':171C 'version':177C 'vulner':3A,118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63619","severity":null,"published_at":"2026-10-16T13:16:57+00:00","modified_at":"2026-10-20T17:17:40+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63619:467","url":null,"severity":null,"published_at":"2026-10-23T23:33:05+00:00","modified_at":"2026-10-23T23:33:05+00:00","first_seen_at":"2026-10-23T23:33:05+00:00","fetched_at":"2026-10-23T23:33:05+00:00","note":"Read Apache's oss-security advisory (Li Yang, 2026-10-16). It does not name the endpoint or the metadata exposed, and the auth detail is only 'insufficient authorization'. Apache rates it moderate; NVD/CNA CVSS is 9.1. No exploitation or PoC found; no social search done."}],"documents":[{"id":2036,"url":"https://www.openwall.com/lists/oss-security/2026/10/16/2","title":"CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump (oss-security, Apache)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}