CVE-2026-63618High· 7.5▾ TwilightExposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 7.5
none → high
0.4%
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108823NoneApache Kylin: Potential unauthenticated job metadata replacement
CVE-2026-69080High· 7.5Apache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-68572High· 7.5Apache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-69076High· 7.5Apache Kylin: Unauthorized cross-project job discard
CVE-2026-69077High· 7.5Apache Kylin: JobController allows unauthorized cross-project manipulation
CVE-2026-108776NoneApache Kylin: tables/names SparkSQL injection