Apache Kylin CVE-2026-69080

Exploitation requires network reachability to the Apache Kylin query server's HTTP management/query interface where the QuerySQLBlacklistController endpoint is exposed; the broken access control means an actor lacking proper authorization can invoke that endpoint and read the SQL blacklist. The affected deployment must run Apache Kylin version 4.0.0 through 5.0.4. Limiting factors: the disclosed asset is only the SQL blacklist configuration (no underlying data, credentials, or code execution), and the practical exposure depends on whether the Kylin interface is network-accessible to untrusted actors versus restricted to an internal/authenticated zone; organizations that already network-isolate Kylin face substantially reduced risk.

This is a broken-access-control information-exposure flaw (CWE-200/CWE-284 class) in Apache Kylin's QuerySQLBlacklistController, where an unauthorized actor can read the configured SQL blacklist. No CVSS vector, EPSS score, KEV listing, SSVC decision, or public POC was provided in any source, so quantitative exploitation signals are entirely absent and cannot be compared - this assessment rests on the vendor's qualitative 'important' rating plus the description. The realistic impact is limited: the exposed asset is a configuration artifact (the SQL blacklist), not data records, credentials, or code execution, so this is a confidentiality-only disclosure rather than a system-compromise vulnerability. Despite the vendor 'important' label, the lack of any integrity/availability impact and the narrow nature of the leaked asset make this a lower real-world priority than a typical network RCE; treat it as a moderate hygiene/hardening fix. Note explicitly: no official CVSS exists, so the attack vector and privilege requirements below are INFERRED from the fact that the affected component is an HTTP controller with broken authorization - verify against the Apache advisory before basing SLAs on them.

An attacker able to reach the Kylin query server's HTTP interface sends a request to the QuerySQLBlacklistController endpoint and, because access control is not properly enforced, receives the SQL blacklist contents despite lacking authorization. This discloses which SQL patterns the operator has chosen to block, information that could help an attacker craft queries that evade those restrictions. No public exploit code was identified at the time of analysis; exploitation is a simple unauthorized HTTP request requiring no special tooling.