Apache Kylin EUVD-2026-104147

Exploitation requires the Apache Kylin job service/job-metadata interface to be reachable by the attacker - the vendor explicitly scopes impact as minor 'unless job services are exposed to public network, which is uncommon,' so a non-default network-exposure deployment is the key precondition. The primary limiting factor is this deployment exposure: in standard installations job services sit behind internal network boundaries and are not public-facing, sharply reducing realistic exploitability. Affected only on Apache Kylin 4.0.0 through 5.0.4; 5.0.5 remediates. Authentication requirements are not confirmed from structured CVSS data (none provided); the advisory title suggests unauthenticated access but no PR metric was supplied to verify this.

This is a moderate-severity information-exposure and metadata-tampering issue (CWE: Exposure of Sensitive Information to an Unauthorized Actor) in Apache Kylin, and the available signals point to LOW real-world priority rather than an urgent threat. No CVSS vector, EPSS score, or SSVC decision data was provided in any source (NVD/vendor list it as N/A), so quantitative exploitation-probability and technical-impact scoring cannot be derived from the input - this is a significant data gap. There is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' The vendor advisory itself downgrades the practical impact: it states the impact is 'minor unless job services are exposed to public network, which is uncommon,' meaning the vulnerable condition depends on a non-default, atypical deployment exposure. The title references 'unauthenticated' access, but because no CVSS vector with a PR metric was supplied, authentication requirements are not confirmed from the structured data and rest only on advisory prose. Net assessment: a genuine but low-urgency issue - the 'moderate' rating, absence of KEV/POC/EPSS, and the vendor's own 'uncommon exposure' caveat all align, so this should be patched on a normal maintenance cycle rather than treated as an emergency.

In an atypical deployment where an Apache Kylin instance's job services are reachable from an untrusted or public network, a remote attacker queries or replaces job metadata without proper authorization, disclosing sensitive job information or substituting attacker-controlled metadata. No public exploit code exists, and exploitation hinges on the job service being network-exposed, which the vendor describes as uncommon.