CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure
Low-privilege users can read Apache Kylin system configuration through version 5.0.4.
Apache disclosed CVE-2026-63618, an important information-exposure flaw in Apache Kylin. Low-privilege users can access system-level configuration information they should not see. Versions from 4 through 5.0.4 are affected, and Apache recommends upgrading to 5.0.5. No exploitation is reported.
- CVE-2026-63618 is rated important by Apache.
- Low-privilege users can read system-level configuration.
- Versions from 4 through 5.0.4 are affected.
- The fix is Apache Kylin 5.0.5.
Vulnerabilities mentionedAll →
- CVE-2026-636187.5—Low-privilege config exposure in Apache Kylinpublished · Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63618 | Low-privilege config exposure in Apache Kylin Apache Kylin versions from 4 through 5.0.4 can expose system-level configuration information to an unauthorized actor (CWE-200). The flaw is described as a low-privilege configuration exposure, so a user who should not see that data can obtain sensitive system configuration. Impact is limited to information disclosure rather than code execution, but leaked settings can aid further attacks. It affects Apache Kylin deployments in that version range. There is no public proof of concept and it is not listed in CISA KEV, so exploitation is none known. The issue is fixed in 5.0.5. Do: Upgrade Apache Kylin to 5.0.5 or later. Until then, restrict who can reach the Kylin web and API endpoints and review logs for unexpected reads of system configuration by low-privilege accounts. |
Posted by Li Yang on Oct 15 Severity: important Affected versions: - Apache Kylin 4..0.0 through 5.0.4 Description: Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. Credit: IcySun (finder) "George Chen" <...
This source does not provide full text. Read it at seclists.org.