EUVD-2026-103147
GHSA-4h4c-qxh3-jw66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Kylin endpoint
-
ExploitAccess improperly protected resource
-
ImpactRetrieve sensitive information disclosed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Apache advisory provides only that Apache Kylin versions 4 through 5.0.4 are affected by a CWE-200 sensitive-information exposure; it does not name the specific endpoint, feature, protocol, or configuration setting that triggers the disclosure, so the concrete precondition cannot be extracted from available data and should be confirmed against the Apache advisory thread. Limiting factors: exploitation is bounded to the affected version range (4 through 5.0.4, fixed in 5.0.5), requires network or application access to a deployed Kylin instance, and whether authentication or a non-default configuration is required is not confirmed because no CVSS vector or detailed description was provided. |
| Impact | Risk signals are sparse: no CVSS vector/score, no EPSS probability, no CISA KEV listing, and no public POC are present in the input, so this cannot currently be ranked as a confirmed priority. The only authoritative signal is the Apache vendor advisory classifying it as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) affecting Apache Kylin 4 through 5.0.4. CWE-200 flaws are typically confidentiality-only with no integrity or availability impact, which caps real-world severity even if network-reachable. The absence of EPSS and KEV data, combined with Apache Kylin's niche analytics-engine deployment footprint, suggests low likelihood of widespread opportunistic exploitation. Key missing data must be flagged explicitly: no CVSS vector is provided, so attack vector, complexity, and privilege requirements are not confirmed - the exact sensitive data exposed and whether authentication is required cannot be determined from the one-line description and should be verified directly against the Apache advisory thread. |
| Exploit ScenarioDerived | An attacker with access to a reachable Apache Kylin instance (version 4 through 5.0.4) queries or accesses a resource that improperly discloses sensitive information - such as configuration data, credentials, or query metadata - to an actor who should not see it. No public exploit code was identified at time of analysis, and because no CVSS vector is provided, whether this requires authentication or user interaction is not confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Sensitive-information exposure in Apache Kylin versions 4 through 5.0.4 permits an authenticated user to obtain data they are not authorized to see, with confidentiality impact rated High while integrity and availability are unaffected. The Apache Kylin project addressed the flaw in version 5.0.5; because the upstream advisory names neither the specific endpoint, feature, nor configuration that triggers the disclosure, the exact attack path must be confirmed against the advisory thread. Risk signals are currently sparse - no CVSS vector or score was supplied with the CVE, no EPSS probability, no CISA KEV listing, and no public exploit code are present in the available data, so this cannot be ranked as a confirmed priority, and no public exploit has been identified at time of analysis.
RemediationAI
The primary fix is to upgrade Apache Kylin to version 5.0.5, the vendor-released patch identified in the advisory (https://lists.apache.org/thread.html/r0boyqp211s7316oclh666bq40vbs9n7); because the vulnerable range spans Kylin 4 through 5.0.4, any instance still on the 4.x line must be moved to 5.0.5 or later rather than merely patched in place. Where an immediate upgrade is not feasible, compensating controls should target the fact that this is a confidentiality-only, authenticated disclosure: restrict network reachability to the Kylin web UI and REST API so that only trusted networks or a reverse proxy with authentication can reach them, accepting the trade-off that legitimate remote analyst and BI-tool access must be routed through that proxy; minimize and audit the accounts that can authenticate to Kylin and review role assignments, understanding that this reduces but does not eliminate exposure from already-privileged users; and rotate any credentials or connection strings stored in cube or data-source metadata, since the disclosure may already have exposed them, with the caveat that rotation causes a brief interruption to scheduled cube builds. Because the specific endpoint or feature involved is not documented, log and review Kylin query, metadata, and administrative API access for unexpected callers, and consult the vendor advisory thread to determine whether a narrower, configuration-specific mitigation applies. Note that no vendor-released patch other than 5.0.5 is identified at time of analysis, and no public exploit code is known, so these controls are precautionary rather than responses to observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, which covers cases where an application returns data to a requester who lacks the privilege to view it - typically through a missing or incorrect authorization check on a query, metadata, or configuration endpoint rather than through memory corruption or injection. Apache Kylin is a distributed OLAP engine that sits over Hadoop/HBase/Spark and exposes a web UI plus REST endpoints for cube design, query execution, and administrative operations; in such deployments the sensitive material at risk is normally cube metadata, connection strings, credentials for backend data sources, query results spanning tenant boundaries, or job/diagnostic output. The affected product identified by CPE is the Apache Software Foundation Apache Kylin package (cpe:2.3:a:apache_software_foundation:apache_kylin), covering the whole 4.x line through 5.0.4. The advisory is deliberately terse and does not identify which component, endpoint, or permission boundary is implicated, so the precise precondition - whether a low-privileged authenticated session, a specific role, or a non-default configuration is required - cannot be derived from the available data and should be validated against the Apache mailing-list advisory before building detections. Authentication is assessed as required based on the assessed vector PR:L (low privileges), meaning an attacker must already hold a valid account on the Kylin instance; the upstream CVE record itself carries no CVSS vector, so that requirement is an analytical assessment rather than a vendor statement.
Know when Apache Kylin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Kylin is a networked web/query service (AV:N) typically behind a login (PR:L); CWE-200 yields confidentiality impact only (C:H, I:N, A:N); PR and C confidence is low given no vendor detail.
Primary rating from Vendor (apache).
DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Executive ViewAI
Apache Kylin, the open-source OLAP engine used for large-scale BI analytics across versions 4 through 5.0.4, contains a sensitive-information exposure flaw that allows a user to retrieve data they are not authorized to see, with confidentiality rated High and no integrity or availability impact. Organizations running Kylin to serve dashboards, financial reporting, or customer-facing analytics should treat this as a data-governance and compliance exposure rather than an availability outage, since the principal risk is unauthorized visibility into business or customer data. Risk signals are sparse and no public exploit has been identified at time of analysis, so this warrants planned remediation within the normal patch cycle rather than emergency escalation.
Apply vendor patch.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Kylin
View allUnauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client t
Code injection in Apache Kylin versions 4 through 5.0.4 lets an attacker who can supply or influence a JDBC URL's 'speci
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific back
Unsafe Java deserialization in Apache Kylin 4 through 5.0.4 allows an attacker who can control, compromise, or network-s
Unauthenticated information disclosure in Apache Kylin 4 through 5.0.4 allows remote attackers to reach a backend metada
Exploit-DB