CVE-2021-27738

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.

• CWE-918
• CWE-918

• http://www.openwall.com/lists/oss-security/2022/01/06/6Mailing List, Third Party Advisory
• https://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/01/06/6Mailing List, Third Party Advisory
• https://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70Mailing List, Vendor Advisory

Published

Jan 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27730Accellion FTA 9_12_432 and earlier is affected by argument i…9.8
• CVE-2021-27731Accellion FTA 9_12_432 and earlier is affected by stored XSS…6.1
• CVE-2021-27733In JetBrains YouTrack before 2020.6.6441, stored XSS was pos…5.4
• CVE-2021-27734Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.x…9.8
• CVE-2021-27736FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks…6.5
• CVE-2021-27737Apache Traffic Server 9.0.0 is vulnerable to a remote DOS at…7.5
• CVE-2021-27741" Security vulnerability in HCL Commerce Management Center a…9.1
• CVE-2021-27746"HCL Connections Security Update for Reflected Cross-Site Sc…5.4
• CVE-2021-27751HCL Commerce is affected by an Insufficient Session Expirati…3.3
• CVE-2021-27753"Sametime Android PathTraversal Vulnerability"5.5
• CVE-2021-27755"Sametime Android potential path traversal vulnerability whe…5.5
• CVE-2021-27756"TLS-RSA cipher suites are not disabled in BigFix Compliance…7.5