EUVD-2026-102851
GHSA-v48x-mj6h-5gwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Kylin endpoint over network
-
ExploitSend unauthenticated request
-
ExecutionServer returns system configuration info
-
ImpactHarvest sensitive configuration details
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected product is Apache Kylin versions 4.0.0 through 5.0.4; an instance must be network-reachable by the attacker. Per CVSS PR:N the request is unauthenticated, and per AC:L no special timing or non-default configuration is indicated, so default-reachable deployments are exposed. Exploitation is LIMITED primarily by network exposure - Kylin instances restricted to internal networks or behind authentication proxies/firewalls reduce reach - and the impact is bounded to confidentiality (disclosure of system-level configuration information) with no integrity or availability effect. Upgrading to 5.0.5 remediates the issue. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) indicates a remotely reachable, low-complexity, unauthenticated information-disclosure flaw with high confidentiality impact but no integrity or availability impact - consistent with the CWE-200 classification and the description's exposure of system-level configuration information. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. The practical risk is therefore moderate: the flaw is easy to trigger if a Kylin instance is network-reachable, but the impact is limited to disclosure of configuration data rather than code execution or data tampering. This is a legitimate confidentiality concern that should be patched, but it is not currently evidence of active or widespread exploitation; the CVSS 'HIGH' rating reflects ease of access more than catastrophic impact. Key missing signals: no EPSS, no KEV, no POC, and no vendor detail on exactly which configuration values are exposed - verify sensitivity of the leaked config (e.g., whether it includes credentials or connection strings) with the Apache advisory. |
| Exploit ScenarioDerived | An attacker who can reach the network interface of an exposed Apache Kylin instance (versions 4 through 5.0.4) sends an unauthenticated request to an endpoint that returns system-level configuration information. The response reveals internal deployment details that could aid further reconnaissance or attacks against backing data stores. No public exploit code is referenced, and the low attack complexity means no special timing or conditions are required beyond network reachability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 16, 2026
Unauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client that can reach the Kylin service retrieve sensitive deployment details, rated CVSS 3.1 base 7.5 (HIGH) with high confidentiality impact but no integrity or availability effect. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, so default-reachable instances are exposed; exposure is limited mainly by whether the instance is network-reachable, and deployments confined to internal networks or placed behind authenticating proxies are significantly less at risk. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so prioritization should be driven by network exposure of Kylin installations rather than by observed exploitation. Upgrading to 5.0.5 is the vendor-recommended fix.
Earlier versions of this analysis (1)
Information disclosure in Apache Kylin versions 4 through 5.0.4 exposes system-level configuration data to an unauthorized party. Because the affected deployments are typically internal OLAP/analytics clusters rather than internet-facing services, real-world exposure depends heavily on whether the Kylin instance is reachable from untrusted networks or shared with lower-privileged tenants. The assessed severity is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting network reachability and a confidentiality-only impact with no integrity or availability loss; no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status.
RemediationAI
Vendor-released patch: Apache Kylin 5.0.5 fixes this issue, and upgrading from any 4.0.0-5.0.4 release to 5.0.5 is the primary and recommended remediation; consult the Apache advisory at https://lists.apache.org/thread.html/5zrg002omkynt3hsjobvkp61yznr6qg3 and the oss-security post at http://www.openwall.com/lists/oss-security/2026/10/16/1 for release and packaging details. Where an immediate upgrade is not feasible, the highest-value compensating control is to eliminate network reachability: firewall or security-group the Kylin HTTP/REST service so that only trusted administrative hosts and trusted application tiers can connect, and bind the service to internal interfaces rather than exposing it to untrusted networks - the trade-off is that legitimate remote or client-facing query access must be rerouted through those trusted paths. Placing Kylin behind an authenticating reverse proxy or SSO gateway adds a required credential check in front of the vulnerable endpoints, since the flaw is rated PR:N and the product itself does not gate the disclosure; the trade-off is added latency, possible breakage of existing anonymous or programmatic integrations, and the need to keep proxy rules in sync with Kylin API paths. Because the impact is read-only configuration disclosure (I:N/A:N), there is no need to disable query functionality, but operators should assume previously exposed deployments may have leaked deployment and cluster configuration and should rotate any secrets, connection strings, or credentials that were stored in or derivable from that configuration, then monitor Kylin access logs and network traffic for reconnaissance-style enumeration of configuration endpoints while remediation is in progress.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Kylin is an open-source distributed OLAP engine that provides a SQL query interface and REST/HTTP service layer on top of big-data storage, commonly used for interactive analytics over very large datasets. The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the root cause is a disclosure class issue rather than memory corruption or injection - the affected component returns system-level configuration information to a requester who should not be able to see it, and the assessed vector (PR:N, AC:L, UI:N, S:U/Scope Unchanged) confirms that the request can be made anonymously, with low complexity, without interaction, and without crossing a security boundary. Confidentiality impact is rated High (C:H) while integrity and availability are None (I:N/A:N), which is consistent with a read-only disclosure of configuration data - for example deployment, cluster, and service settings - that could be reused for reconnaissance, credential discovery, or planning follow-on attacks against the Kylin host and its backing big-data cluster. The affected CPE (cpe:2.3:a:apache_software_foundation:apache_kylin) covers the whole product line from the 4.0.0 baseline through 5.0.4, and ENISA EUVD tracks the same range under EUVD-2026-102851.
Know when Apache Kylin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, unauthenticated, low-complexity disclosure endpoint gives AV:N/AC:L/PR:N/UI:N; impact is confidentiality-only (C:H, I:N, A:N) with unchanged scope.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Executive ViewAI
Apache Kylin installations running versions 4.0.0 through 5.0.4 expose sensitive deployment and system-level configuration details to any client that can reach the service, and because the flaw is unauthenticated (CVSS vector PR:N) it requires no credentials, user interaction, or non-default configuration on the target. Leadership should care because any Kylin instance reachable beyond a trusted internal network - including analytics, development, or internet-facing deployments - leaks internal architecture details that can shorten an attacker's path to deeper compromise, even though there is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status. Risk is driven almost entirely by network exposure, so instances confined to segmented internal networks or placed behind authenticating proxies are substantially less exposed.
No vendor-released patch identified at time of analysis; interim mitigations include isolating Kylin behind network segmentation or a VPN, enforcing authentication at an authenticating reverse proxy or API gateway, restricting access with deny-by-default firewall and security-group rules, keeping Kylin reachable only from trusted internal networks, monitoring and alerting on requests to configuration and system-information endpoints, and applying the vendor-recommended upgrade to Apache Kylin 5.0.5 as soon as it can be scheduled.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Kylin
View allSensitive-information exposure in Apache Kylin versions 4 through 5.0.4 permits an authenticated user to obtain data the
Code injection in Apache Kylin versions 4 through 5.0.4 lets an attacker who can supply or influence a JDBC URL's 'speci
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific back
Unsafe Java deserialization in Apache Kylin 4 through 5.0.4 allows an attacker who can control, compromise, or network-s
Unauthenticated information disclosure in Apache Kylin 4 through 5.0.4 allows remote attackers to reach a backend metada
Exploit-DB