What is the CVSS score of CVE-2026-62393?

CVE-2026-62393 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Apache Kylin are affected by CVE-2026-62393?

Apache Kylin REST API in versions 4.0-5.0.3 fails to enforce project-level access controls on job metadata endpoints, allowing any authenticated Kylin user to retrieve job information across all…

How to fix or mitigate CVE-2026-62393?

Within 24 hours: Inventory all Apache Kylin deployments and identify instances running versions 4.0-5.0.3. Within 7 days: Restrict network access to JobController REST API endpoints (getJobList, getJobDetail) to administrative networks only, and enable comprehensive audit logging for all Kylin API calls. Within 30 days: Establish a vendor patch monitoring process for Apache Kylin 5.0.4 or later; deploy immediately upon release. In the interim, implement Web Application Firewall rules to enforce project parameter validation on API requests and restrict cross-project queries.

Apache Kylin CVE-2026-62393

EUVD-2026-43665 MEDIUM

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-07-14

GHSA-9rx7-cp4p-rwx4

Authentication Bypass Apache Kylin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable REST API (AV:N, AC:L); requires authenticated low-privilege user (PR:L); read-only job metadata disclosure, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 14, 2026 - 17:07 NVD

4.3 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 04:16 vuln.today

CVE Published

Jul 14, 2026 - 04:03 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Improper Authorization in Apache Kylin REST API - CVE-2026-62393 Jul 14, 2026

AnalysisAI

Improper authorization in Apache Kylin's REST API job endpoints allows authenticated users to retrieve job metadata from projects they are not authorized to access. The JobController.getJobList and JobController.getJobDetail endpoints lack project-scoped permission verification, meaning any authenticated user can query build job information across project boundaries within a shared Kylin deployment. Apache Kylin versions 4 through 5.0.3 are affected; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Apache Kylin is an open-source distributed OLAP engine built on top of Hadoop/Hive ecosystems, designed for sub-second query performance over massive datasets via pre-computed cubes and indexes. The vulnerability resides in its REST API layer, specifically in the JobController component, which exposes two affected endpoints: getJobList and getJobDetail. These endpoints handle retrieval of build job status and details scoped to projects - Kylin's primary multi-tenancy boundary. The root cause is a missing authorization check: the API authenticates the requesting user but omits validation of whether that user holds permissions for the project associated with the requested job. This aligns with CWE-862 (Missing Authorization), where the authorization logic is not absent globally but is simply not applied at the resource-level (project) boundary. Affected versions span Apache Kylin 4 through 5.0.3, with the fix committed under KYLIN-6090 and released in 5.0.4.

RemediationAI

Vendor-released patch: Apache Kylin 5.0.4, which adds project permission verification to the JobController.getJobList and JobController.getJobDetail REST API endpoints. Users running any Kylin 4.x or 5.0.x release through 5.0.3 should upgrade to 5.0.4 immediately; this is the only confirmed fix per the advisory at https://kylin.apache.org/. If immediate upgrade is not feasible, a compensating control is to restrict network access to the Kylin REST API to only trusted internal clients or services, preventing cross-tenant users from reaching the job endpoints directly - note this trade-off reduces usability for legitimate remote API consumers. Additionally, administrators can audit Kylin project membership to ensure users are only assigned to projects they legitimately belong to, reducing the data exposed if the vulnerability is exploited before patching. No workaround that preserves full API functionality while blocking the vulnerability is documented.