CVE-2021-27738: Improper Access Control to Streaming Coordinator & SSRF

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-06 · updated 2026-06-17
Weakness: CWE-918

Description

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.

Affected products

Apache Software Foundation Apache Kylin: from 3.0.0 before 3.1.2 — fixed in 3.1.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Kylin 3.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-27738 or the next vulnerability affects your stack