CVE-2021-45457: Apache Kylin

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

Affected products

• Apache Kylin: from 2.0.0, up to and including 2.6.6; from 3.0.0, before 3.1.3 (fixed in 3.1.3); version 4.0.0 only

Published 2022-01-06. Last modified 2026-06-17.