# CVE-2026-62393: Apache Kylin improper authorization in job information retrieval

Source: https://junglewise.ai/threats/cve-2026-62393-apache-kylin-improper-authorization-in-job-information-retrieval  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-62393 · Severity: info · CVSS 0 · Published 2026-07-14

Apache Kylin, an analytics engine used for processing large datasets, contains a security flaw in how it manages user permissions. An attacker with access to the system could view sensitive job information belonging to other projects that they are not authorized to see. This could lead to the exposure of internal data processing details and metadata across different business units or projects.

## Quick answers

**Is CVE-2026-62393 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62393 being exploited in the wild.

**How severe is CVE-2026-62393?** Informational severity, with a CVSS score of 0, published 14 July 2026.

**Which products and versions are affected?** Apache Kylin 4 through 5.0.3.

**Is there a fix for CVE-2026-62393?** A patch was published on 2026-07-14: Fixed in version 5.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62393 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62393?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-280) exists in Apache Kylin's job information retrieval mechanism. The root cause is a failure to properly validate project-level permissions when a user requests job metadata. An authenticated attacker can exploit this by querying job information for projects outside of their assigned scope, potentially gaining insights into data processing workflows and metadata of other tenants. The vulnerability affects versions 4 through 5.0.3 and is resolved in version 5.0.4.

## Affected products

- Apache Kylin 4 through 5.0.3

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: advisory
- 2026-07-14: patched: Fixed in version 5.0.4

## References

- [https://lists.apache.org/thread/xg8dcyjw0nkq5y8dhq3r25x3rxc62x9j](https://lists.apache.org/thread/xg8dcyjw0nkq5y8dhq3r25x3rxc62x9j)
- [http://www.openwall.com/lists/oss-security/2026/07/14/6](http://www.openwall.com/lists/oss-security/2026/07/14/6)