CVE-2026-63618 PUBLISHED

Apache Kylin: Low-Privilege Config Exposure

Assigner: apache
Reserved: 17.07.2026 Published: 16.10.2026 Updated: 16.10.2026

Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Kylin
Versions Default: unaffected
  • affected from 4..0.0 to 5.0.4 (incl.)

Credits

  • IcySun <icysun@qq.com> finder
  • "George Chen" <http://github.com/geo-chen> finder

References

Problem Types

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE