CVE-2021-45457: Apache Kylin - Cross-origin requests with credentials allowed from any origin
Summary
CVE-2021-45457: In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. Affects org.apache.kylin:kylin across 2 version ranges.
< 3.1.3
>= 4.0.0, < 4.0.1
Fixed in 3.1.3 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kylin is an open-source distributed analytics engine designed to provide SQL interface and multi-dimensional analysis (OLAP) on big data for data warehousing. It allows users to query large-scale datasets in real-time and provides various features for data modeling, cube building, and query optimization. However, a vulnerability has been discovered in Apache Kylin that allows cross-origin requests with credentials to be sent from any origin.
Vulnerability Detail
The vulnerability in Apache Kylin allows cross-origin requests with credentials to be sent from any origin. This means that an attacker can potentially exploit this vulnerability to perform unauthorized actions on behalf of a user, such as stealing sensitive information or performing malicious operations. The vulnerability affects Apache Kylin versions 2.6.6 and prior, 3.1.2 and prior, and 4.0.0 and prior.
How To Fix
Latest published version: 5.0.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.1.33.1.3 -
>= 4.0.0, < 4.0.14.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly recommended to upgrade to the fixed versions of Apache Kylin as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the vulnerability in Apache Kylin allows cross-origin requests with credentials to be sent from any origin, potentially leading to unauthorized actions on behalf of a user. It is crucial to upgrade to the fixed versions of Apache Kylin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
Apache Kylin is an open-source distributed analytics engine designed for big data analysis and OLAP on large-scale datasets.
This vulnerability allows cross-origin requests with credentials from any origin, potentially enabling unauthorized actions on behalf of a user.
The vulnerability affects Apache Kylin versions 2.6.6 and prior, 3.1.2 and prior, and 4.0.0 and prior.
To fix this vulnerability, upgrade to the fixed versions of Apache Kylin: 2.6.7 or later for Apache Kylin 2, 3.1.3 or later for Apache Kylin 3, and 4.0.1 or later for Apache Kylin 4.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of Apache Kylin.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
