Missing authorization on JDBC source configuration updates in Apache Kylin allows attackers who can reach the service to alter database connection settings without proper privileges. This flaw provides a shortcut to redirect data queries or insert malicious commands via the changed connection, effectively granting unauthorized access to Kylin’s underlying data store and potentially exposing sensitive information.

Apache Software Foundation’s Apache Kylin, versions 4.0.0 through 5.0.4, are impacted. The issue is most relevant for deployments that expose Kylin services directly to the public network, while in-house, isolated installations are unlikely to be affected.

An attacker must reach the exposed Kylin endpoint and submit an update request, which is straightforward through HTTP. The CVSS score is 6.5, indicating a moderate risk, and the EPSS score is below 1%, suggesting the likelihood of exploitation is low. However, the absence of an authorization check still allows an attacker to modify JDBC source configuration for an exposed service, potentially redirecting data queries or inserting malicious commands. Consequently, publicly reachable instances are at significant risk for data tampering or exposure. The vulnerability is not listed in CISA’s KEV catalog.