AI analysis
Apache Kylin versions from 4 through 5.0.4 have an exposure-of-sensitive-information flaw (CWE-200) that can let an unauthorized actor obtain data they should not see. The Apache advisory does not describe a detailed trigger; related reporting characterizes the issue as unauthorized SQL execution into the Spark SQL environment. An attacker who can reach a vulnerable instance may disclose sensitive information handled by Kylin. Organizations running Apache Kylin in that version range are affected, and the vendor fix is 5.0.5. No public proof of concept is known, the issue is not in CISA KEV, and exploitation in the wild is not known.
What to do: Upgrade Apache Kylin to 5.0.5. Until the upgrade is complete, restrict network access to Kylin and its Spark SQL interfaces to trusted users and review logs for unexpected SQL or data-access activity.
Affected
| Apache Kylin | 4 through 5.0.4 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.