Low-privilege config exposure in Apache Kylin
Apache Kylin versions from 4 through 5.0.4 can expose system-level configuration information to an unauthorized actor (CWE-200). The flaw is described as a low-privilege configuration exposure, so a user who should not see that data can obtain sensitive system configuration. Impact is limited to information disclosure rather than code execution, but leaked settings can aid further attacks. It affects Apache Kylin deployments in that version range. There is no public proof of concept and it is not listed in CISA KEV, so exploitation is none known. The issue is fixed in 5.0.5.
What to do: Upgrade Apache Kylin to 5.0.5 or later. Until then, restrict who can reach the Kylin web and API endpoints and review logs for unexpected reads of system configuration by low-privilege accounts.
| Apache Kylin | 4 through 5.0.4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Low-privilege users can read Apache Kylin system configuration through version 5.0.4.
Apache disclosed CVE-2026-63618, an important information-exposure flaw in Apache Kylin. Low-privilege users can access system-level configuration information they should not see. Versions from 4 through 5.0.4 are affected, and Apache recommends upgrading to 5.0.5. No exploitation is reported.