---
id: "CVE-2026-63619"
kind: "vulnerability"
aliases: ["CVE-2026-63619"]
title: "Missing Authorization vulnerability in Apache Kylin"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Apache Kylin", "fixed": ["5.0.5"], "affected": ">= 4.0.0, <= 5.0.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["apache-kylin", "big-data", "missing-authorization", "package", "path-traversal", "self-hosted"]
not_affected_if: ["in-house-only-network", "internal-network-only", "kylin-version-5.0.5-or-later", "not-internet-exposed"]
published_at: "2026-10-16T13:16:57+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:33:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63619", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:33:05+00:00"}]
---

# Missing Authorization vulnerability in Apache Kylin

Apache Kylin 4.0.0 through 5.0.4 has a backend system metadata dump API with insufficient authorization and no path confinement. Apache says the impact is mostly on Kylin services exposed directly to a public network, and in-house deployments are mostly not affected. The advisory does not name the endpoint or list the metadata exposed. Tracked as KYLIN-6093 and KYLIN-6102. Credit: George Chen, n0mi1k Security, MopMonk-AI. Part of a batch of about 20 Kylin CVEs published 2026-10-16, so upgrade once.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Kylin affected >= 4.0.0, <= 5.0.4 fixed 5.0.5

## How to check

Run 'kylin.sh version' or look at the Kylin jar or release version: 4.0.0 through 5.0.4 is affected. Then check whether the Kylin HTTP port (7070 by default) is reachable from the internet or an untrusted network. The specific endpoint is not published, so unknown.

## Fix

Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin to the public internet; restrict it with a firewall or reverse-proxy allowlist.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63619
- 2026-10-23T23:33:05+00:00 analyst — Read Apache's oss-security advisory (Li Yang, 2026-10-16). It does not name the endpoint or the metadata exposed, and the auth detail is only 'insufficient authorization'. Apache rates it moderate; NVD/CNA CVSS is 9.1. No exploitation or PoC found; no social search done.

## Documents

- [advisory] CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump (oss-security, Apache) https://www.openwall.com/lists/oss-security/2026/10/16/2

## From the sources

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_