The vulnerability permits an unauthenticated attacker within an internal network to broadcast metadata to Apache Kylin services, enabling unauthorized access to configuration information. The flaw does not allow the attacker to execute arbitrary code, but the exposure of metadata can lead to confidential information leakage and potential privilege escalation within a compromised environment. The weakness is classified as CWE‑287, improper authentication.

Apache Kylin versions from 4.0.4 through 5.0.4 are affected. The issue mainly impacts deployments where Kylin services are exposed to the public network; typical in‑house deployments are usually not affected.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, providing no concrete evidence of widespread exploitation. The attack vector is inferred to be internal, requiring network access to the Kylin service, but no public-facing exploit is reported. The CVSS score is undefined in the provided data, so the overall risk is uncertain; however, because unauthorized metadata handling can compromise data integrity and confidentiality, patching is recommended.