Apache Kylin: Missing authentication and unsafe deserialization in broadcast API
Summary
Apache Kylin 4.0.0 through 5.0.4 contains a missing authentication flaw (CWE-306) in an internal broadcast API, combined with polymorphic deserialization. The CVE record describes possible remote code execution or data exfiltration by an unauthenticated attacker. The main risk applies to Kylin services that are directly reachable from the public internet; in-house deployments are mostly not affected according to the vendor record.
Affected
- Apache Kylin 4.0.0 through 5.0.4
Fixed in
- Apache Kylin 5.0.5
- Fix for the 4.x line: Unknown.
Workaround
- No vendor-documented workaround specific to this CVE is known.
- Until upgraded, block external access to Kylin service ports and restrict them to management networks.
Exploitation
- Known exploitation: none found. Not listed in CISA KEV.
- Public proof of concept: none found; status is unknown rather than confirmed absent.
- CISA SSVC: automatable yes, technical impact total.
- EPSS about 0.002 (low).
Our recommendation
- Check whether any Kylin 4.x or 5.0.x (up to 5.0.4) instance is reachable from the internet and treat such instances as urgent.
- Block external access to Kylin ports until the system is upgraded.
- Upgrade to Apache Kylin 5.0.5; for 4.x, check with the vendor for a fix.
- Check the inventory for Kylin, including Kylin-based BI stacks.
- Monitor logs for unexpected requests to the Kylin broadcast API.
- Note: the CVSS score of 9.8 is not yet confirmed by NVD (status Deferred); other sources list 8.1 (CVSS 3.1) and 9.2 (CVSS 4).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache oss-security mailing list post www.openwall.com
- Apache vendor thread lists.apache.org
- OpenCVE CVE record app.opencve.io
- Strix CVE details www.strix.ai
- HOL Guard version range hol.org
- Mend/Vulners CVSS and EPSS vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:21.
Original description (NVD)
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.