You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@kylin.apache.org by "liyang (Jira)" <ji...@apache.org> on 2026/10/11 12:36:00 UTC

[jira] [Resolved] (KYLIN-6118) Potential unauthorized internal job-report RPC issue

     [ https://issues.apache.org/jira/browse/KYLIN-6118?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

liyang resolved KYLIN-6118.
---------------------------
    Resolution: Fixed

> Potential unauthorized internal job-report RPC issue
> ----------------------------------------------------
>
>                 Key: KYLIN-6118
>                 URL: https://issues.apache.org/jira/browse/KYLIN-6118
>             Project: Kylin
>          Issue Type: Bug
>            Reporter: liyang
>            Assignee: liyang
>            Priority: Major
>             Fix For: 5.0.5
>
>
> Several internal job progress-report RPC operations are exposed on the public API port and are marked as public in the security chain, but they do not verify the caller identity or authorization. A caller that knows a running job identifier and its running-start value can submit forged progress, error, stage-status, and wait/run-time updates to job metadata.
> The affected operations are the internal job progress-report RPC endpoints under the job controller.
> Fix direction: require either an authenticated global administrator or a valid internal service credential on these internal RPC operations, and have the internal job-progress reporter send the credential.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)