# CVE-2026-63619: Apache Kylin missing authorization in metadata dump API

Source: https://junglewise.ai/threats/cve-2026-63619-missing-authorization-vulnerability-in-apache-kylin-a-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-63619 · Severity: info · Published 2026-10-16

Apache Kylin is a data analytics platform that provides metadata and system dump APIs. A missing authorization check in the metadata dump API allows unauthorized access to sensitive system metadata. The vulnerability primarily affects Kylin deployments exposed directly to the public internet, which is uncommon; most in-house deployments are protected by network perimeter controls.

Technologies: [Apache Kylin](https://junglewise.ai/threats/technologies/kylin). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-63619 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63619 being exploited in the wild.

**How severe is CVE-2026-63619?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** Apache Kylin 4.0.0 through 5.0.4.

**Is there a fix for CVE-2026-63619?** Yes: fixed in 5.0.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63619 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63619?** Check whether you run Apache Kylin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.5

## Technical details

A backend metadata dump API in Apache Kylin fails to enforce sufficient authorization checks and lacks proper path-confinement controls. An attacker with network access to the API can request sensitive metadata dumps without authentication or authorization verification, potentially exposing configuration and system information. A fix is available in version 5.0.5.

## Affected products

- Apache Kylin 4.0.0 through 5.0.4

## Timeline

- 2026-10-16: disclosed
- 2026-10-16: patched: version 5.0.5 released

## References

- [https://lists.apache.org/thread.html/p3rzz43h1kqc55wjshxmx2dbbmx76qrg](https://lists.apache.org/thread.html/p3rzz43h1kqc55wjshxmx2dbbmx76qrg)
- [http://www.openwall.com/lists/oss-security/2026/10/16/2](http://www.openwall.com/lists/oss-security/2026/10/16/2)

## Related threats

- [Apache Kylin resource exhaustion in cache API](https://junglewise.ai/threats/cve-2026-108837-allocation-of-resources-without-limits-or-throttling)
- [Apache Kylin default startup profile missing security settings](https://junglewise.ai/threats/cve-2026-108833-default-startup-profile-miss-security-settings-in-apache-kylin)
- [Apache Kylin information disclosure in job manipulation](https://junglewise.ai/threats/cve-2026-108823-exposure-of-sensitive-information-to-an-unauthorized-actor)
- [Apache Kylin JDBC source configuration validation vulnerability](https://junglewise.ai/threats/cve-2026-108780-potential-jdbc-source-configuration-validation-vulnerability-in)
- [Apache Kylin SQL injection in query processing](https://junglewise.ai/threats/cve-2026-108776-improper-neutralization-of-special-elements-used-in-an-sql)