Apache Kylin exposes an internal broadcast API that is not protected by authentication and also deserializes data polymorphically. The absence of authentication allows an unauthenticated attacker to invoke the broadcast endpoint, and the ability to supply data that triggers polymorphic deserialization can lead to remote code execution or unauthorized data disclosure. This combination of missing authorization and unsafe deserialization is a critical security weakness that could compromise the integrity and confidentiality of the system if the API is reachable over the network.

The vulnerability affects Apache Kylin versions 4.0.0 through 5.0.4. Deployments that expose Kylin services directly to the public network are most vulnerable, while typical internal deployments are less likely to be impacted unless the broadcast API is reachable from outside.

The CVSS score is not provided, and the EPSS score is not available, but the lack of authentication applied to a network‑exposed API presents a high risk of exploitation, especially if the endpoint can receive crafted payloads that trigger the polymorphic deserialization. The flaw is not currently listed in the CISA KEV catalog, yet an attacker who can reach the broadcast endpoint could abuse the vulnerability. Because no procedural workaround is offered by the vendor, the only reliable protection is to eliminate the unauthenticated access path or upgrade to the fixed version.