CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure

Apache Kylin versions from 4 through 5.0.4 are affected.

Upgrade Apache Kylin to version 5.0.5, which fixes the vulnerability.

Published Oct 16, 2026

Updated

Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=4<=5.0.4

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Oct 16, 2026

CVE Published

via MITRE·12:11 PM

Data Sourced

via MITRE·12:11 PM

DescriptionWeakness

Apache Kylin versions from 4 through 5.0.4 are affected.

Upgrade Apache Kylin to version 5.0.5, which fixes the vulnerability.