The vulnerability allows an unauthenticated attacker who can reach the Kylin service from within the internal network to broadcast metadata, effectively bypassing authentication and gaining unauthorized access to configuration information. While it does not enable arbitrary code execution, the flaw compromises the confidentiality and integrity of metadata and can facilitate privilege escalation within a compromised environment. The weakness is categorized as improper authentication (CWE‑287).

Apache Kylin versions 4.0.4 through 5.0.4 are affected. Deployments that expose Kylin services to the external network are at risk, whereas most in‑house deployments do not expose these services and are not directly impacted.

The CVSS score of 9.8 denotes a critical severity. The EPSS score is reported as < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no confirmed large‑scale attacks have been reported. The attack vector is internal, requiring network access to the Kylin service; a malicious actor with such access can broadcast metadata and bypass authentication to read sensitive configuration data. Given the high severity and the possibility of privilege escalation in compromised environments, immediate patching or tightening of network controls is recommended.