AI analysis
Apache Kylin versions from 4 through 5.0.4 expose the SQL blacklist to an unauthorized actor through broken access control in QuerySQLBlacklistController (CWE-200). An attacker who can reach the affected controller can read blacklist contents they should not see, which can reveal blocked SQL patterns and related query rules. The issue is fixed in 5.0.5. It is not listed in CISA KEV, has no known public proof of concept, and has no known in-the-wild exploitation.
What to do: Upgrade Apache Kylin to 5.0.5 or later. Until then, restrict network access to the Kylin management and query APIs (including QuerySQLBlacklistController) to trusted administrators only, and review access logs for unauthorized reads of the SQL blacklist.
Affected
| Apache Software Foundation Apache Kylin | 4 through 5.0.4 |
Estimated exposure
nichelow thousands of enterprise deployments — Apache Kylin is a specialized enterprise OLAP engine usually run on internal big-data clusters rather than as a mass public web app; the advisory gives no install census or internet-scan count, so this is only an order-of-magnitude…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.