Apache Kylin
Monthly
Sensitive-information exposure in Apache Kylin versions 4 through 5.0.4 permits an authenticated user to obtain data they are not authorized to see, with confidentiality impact rated High while integrity and availability are unaffected. The Apache Kylin project addressed the flaw in version 5.0.5; because the upstream advisory names neither the specific endpoint, feature, nor configuration that triggers the disclosure, the exact attack path must be confirmed against the advisory thread. Risk signals are currently sparse - no CVSS vector or score was supplied with the CVE, no EPSS probability, no CISA KEV listing, and no public exploit code are present in the available data, so this cannot be ranked as a confirmed priority, and no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.
Unauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client that can reach the Kylin service retrieve sensitive deployment details, rated CVSS 3.1 base 7.5 (HIGH) with high confidentiality impact but no integrity or availability effect. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, so default-reachable instances are exposed; exposure is limited mainly by whether the instance is network-reachable, and deployments confined to internal networks or placed behind authenticating proxies are significantly less at risk. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so prioritization should be driven by network exposure of Kylin installations rather than by observed exploitation. Upgrading to 5.0.5 is the vendor-recommended fix.
Code injection in Apache Kylin versions 4 through 5.0.4 lets an attacker who can supply or influence a JDBC URL's 'special parameter' trigger generation of attacker-controlled code in the context of the Kylin service, with the assessed vector rating confidentiality, integrity and availability impact as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Per the vendor, practical risk is concentrated on Kylin services directly exposed to the public network, which Apache describes as uncommon, while typical in-house deployments are mostly not impacted; exposure of the datasource/JDBC configuration path is therefore the principal limiting factor. No CISA KEV listing, EPSS score, or public proof-of-concept is present in the available intelligence, so no public exploit has been identified at time of analysis, and upgrading to 5.0.5 removes the vulnerable condition.
Unsafe Java deserialization in Apache Kylin 4 through 5.0.4 allows an attacker who can control, compromise, or network-spoof the external cache service that Kylin is configured to query to feed crafted serialized objects into the Kylin process and potentially achieve arbitrary code execution, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack is not unconditional: it requires Kylin to be deployed with an external cache backend whose responses the attacker can manipulate, and clusters using a trusted, isolated, authenticated cache are not directly reachable through this path. No public exploit identified at time of analysis, no CISA KEV listing, no EPSS probability is reported, and the source supplied no CVSS score or vector, so exploitation likelihood rests solely on the CWE-502 root cause and the described preconditions.
Unauthenticated information disclosure in Apache Kylin 4 through 5.0.4 allows remote attackers to reach a backend metadata dump API that enforces neither authorization nor path confinement, exposing cluster metadata and, because the path-confinement check is also missing, potentially files outside the intended directory scope (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Practical impact is bounded by deployment topology rather than by credential checks: the Apache advisory states the risk is material mainly where a Kylin service is directly exposed to the public network, which it describes as uncommon, and in-house/internal-only deployments are mostly unaffected. No CISA KEV listing, no EPSS probability, and no public exploit code are present in the available intelligence, so there is no public exploit identified at time of analysis; the vendor-released patch is 5.0.5.
Sensitive-information exposure in Apache Kylin versions 4 through 5.0.4 permits an authenticated user to obtain data they are not authorized to see, with confidentiality impact rated High while integrity and availability are unaffected. The Apache Kylin project addressed the flaw in version 5.0.5; because the upstream advisory names neither the specific endpoint, feature, nor configuration that triggers the disclosure, the exact attack path must be confirmed against the advisory thread. Risk signals are currently sparse - no CVSS vector or score was supplied with the CVE, no EPSS probability, no CISA KEV listing, and no public exploit code are present in the available data, so this cannot be ranked as a confirmed priority, and no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.
Unauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client that can reach the Kylin service retrieve sensitive deployment details, rated CVSS 3.1 base 7.5 (HIGH) with high confidentiality impact but no integrity or availability effect. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, so default-reachable instances are exposed; exposure is limited mainly by whether the instance is network-reachable, and deployments confined to internal networks or placed behind authenticating proxies are significantly less at risk. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so prioritization should be driven by network exposure of Kylin installations rather than by observed exploitation. Upgrading to 5.0.5 is the vendor-recommended fix.
Code injection in Apache Kylin versions 4 through 5.0.4 lets an attacker who can supply or influence a JDBC URL's 'special parameter' trigger generation of attacker-controlled code in the context of the Kylin service, with the assessed vector rating confidentiality, integrity and availability impact as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Per the vendor, practical risk is concentrated on Kylin services directly exposed to the public network, which Apache describes as uncommon, while typical in-house deployments are mostly not impacted; exposure of the datasource/JDBC configuration path is therefore the principal limiting factor. No CISA KEV listing, EPSS score, or public proof-of-concept is present in the available intelligence, so no public exploit has been identified at time of analysis, and upgrading to 5.0.5 removes the vulnerable condition.
Unsafe Java deserialization in Apache Kylin 4 through 5.0.4 allows an attacker who can control, compromise, or network-spoof the external cache service that Kylin is configured to query to feed crafted serialized objects into the Kylin process and potentially achieve arbitrary code execution, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack is not unconditional: it requires Kylin to be deployed with an external cache backend whose responses the attacker can manipulate, and clusters using a trusted, isolated, authenticated cache are not directly reachable through this path. No public exploit identified at time of analysis, no CISA KEV listing, no EPSS probability is reported, and the source supplied no CVSS score or vector, so exploitation likelihood rests solely on the CWE-502 root cause and the described preconditions.
Unauthenticated information disclosure in Apache Kylin 4 through 5.0.4 allows remote attackers to reach a backend metadata dump API that enforces neither authorization nor path confinement, exposing cluster metadata and, because the path-confinement check is also missing, potentially files outside the intended directory scope (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Practical impact is bounded by deployment topology rather than by credential checks: the Apache advisory states the risk is material mainly where a Kylin service is directly exposed to the public network, which it describes as uncommon, and in-house/internal-only deployments are mostly unaffected. No CISA KEV listing, no EPSS probability, and no public exploit code are present in the available intelligence, so there is no public exploit identified at time of analysis; the vendor-released patch is 5.0.5.