oss-sec mailing list archives

CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure

From: Li Yang <liyang () apache org>
Date: Fri, 16 Oct 2026 02:24:10 +0000

Severity: important 

Affected versions:

- Apache Kylin 4..0.0 through 5.0.4

Description:

Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache 
Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Credit:

IcySun <icysun () qq com> (finder)
"George Chen" <http://github.com/geo-chen> (finder)

References:

https://kylin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-63618

Current thread:

CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure Li Yang (Oct 15)