CVE-2026-62393
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
An improper authorization vulnerability in Apache Kylin allows an attacker to access unauthorized jobs in other projects during job information retrieval.
Risk Assessment
The risk involves potential leakage of sensitive job information and breach of project isolation, which could lead to unauthorized data access.
Recommendation
Upgrade Apache Kylin to version 5.0.4 immediately to remediate this vulnerability.
Other vulnerabilities in Apache Kylin
See all- CVE-2026-62392Critical
An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.
- CVE-2026-62390Critical
An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.
Original NVD description (English source)
Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.