TI-2021-09147 Aliases CVE-2021-27738 GHSA-wrx7-qgmj-mf2q

Improper Access Control to Streaming Coordinator & SSRF

LOW 38CWE-918Published 2022-01-06 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.

Why it matters now

EPSS 0.02641 85th percentileScored 2026-11-07

Fix Fixed Apache Kylin (Apache Software Foundation): 3.1.2org.apache.kylin:kylin (Maven): 3.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Kylin	Apache Kylin 3 to before 3.1.2	3.1.2	Patch available	CNA
—	org.apache.kylin:kylin (Maven)	before 3.1.3	3.1.3	Patch available	GHSA-wrx7-qgmj-mf2q

Apache Kylin VendorApache Affected Apache Kylin 3 to before 3.1.2 Fixed in 3.1.2 Patch available CNA
org.apache.kylin:kylin (Maven) Vendor— Affected before 3.1.3 Fixed in 3.1.3 Patch available GHSA-wrx7-qgmj-mf2q

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:kylin::::::::	3.0.0 to before 3.1.2	Vulnerable	Apache

cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.1.2 Vulnerable ·Apache

Remediation

Fix · CNA Apache Kylin (Apache Software Foundation) Fixed in 3.1.2
Fix · GHSA-wrx7-qgmj-mf2q org.apache.kylin:kylin (Maven) Fixed in 3.1.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-27738
2026-10-03 Alias added: GHSA-wrx7-qgmj-mf2q

References

Advisory 3

Other 2

TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences