Apache Kylin CVE-2026-63619

Exploitation requires network reachability to the Kylin backend metadata dump API; per the Apache advisory the material risk arises only when the Kylin service is directly exposed to the public (untrusted) network, which the vendor states is uncommon, and in-house/internal-only deployments are mostly unaffected. Affected versions are Apache Kylin 4 through 5.0.4; upgrading to 5.0.5 remediates. The dominant limiting factor is deployment topology - internal/firewalled Kylin instances are not practically exposed - rather than any authentication requirement, since the flaw is precisely the absence of authorization enforcement on the API.

Signal availability is sparse: no CVSS vector/score, no EPSS probability, no CISA KEV listing, and no public POC are present in the input, so most quantitative exploitation signals are MISSING and cannot be compared. The qualitative data is a CWE-862 Missing Authorization flaw in a backend metadata dump API that also lacks path-confinement, which points to a confidentiality-oriented information-disclosure issue rather than remote code execution. The vendor (Apache) explicitly scopes real-world risk downward: exploitation 'impacts most' only Kylin services directly exposed to the public network, and states this exposure 'is not common' and that in-house deployments are 'mostly not impacted' - so the practical priority is LOW-to-MEDIUM despite the serious-sounding authorization-bypass class. This is best treated as a conditional, exposure-dependent issue rather than a high-urgency widespread threat; absent EPSS/KEV/POC there is no evidence of active or imminent exploitation. Note the tag 'Authentication Bypass' slightly overstates the mechanism - the underlying weakness is missing authorization (CWE-862) on an API, not authentication bypass of login; verify intent with the Apache advisory.

An attacker who can reach an internet-exposed Apache Kylin instance issues a request to the backend metadata dump API, which fails to enforce authorization and does not confine file paths, returning internal metadata and potentially files outside the intended scope. No public exploit code was identified in the provided data, and the vendor notes such public exposure is uncommon, limiting realistic opportunity.