This vulnerability is an OS command injection flaw that occurs when Apache Kylin processes a spark job submission. An attacker can craft input that causes the Kylin service to execute arbitrary operating‑system commands, potentially providing full system compromise for the host running the service. The flaw is associated with CWE‑78 and affects the command execution path of Kylin’s public‑facing API.

Apache Kylin versions spanning from 4.0.4 through 5.0.4 are affected. The issue is present in the spark job submission component, meaning any deployment running these versions and that exposes the Kylin service to external networks is potentially vulnerable. In‑house deployments that are not publicly reachable are less likely to be impacted directly.

The vulnerability allows remote execution of system commands; however, the exploit requires access to the spark job submission interface, which is typically restricted. No EPSS score is available and the CVE is not listed in the CISA KEV catalog, so formal risk metrics are not published. The attack vector is inferred to be an external network interface because the description notes impact “most to the kylin services that are directly exposed to public network.” Consequently, the risk is considered high for exposed services but could be mitigated by limiting network reachability or disabling the vulnerable endpoint.