The vulnerability is a SQL Injection flaw in Apache Kylin's handling of table and name inputs used within SparkSQL queries. Because the application fails to properly escape or validate these inputs, an attacker could inject arbitrary SQL statements. This could allow unauthorized access, data disclosure, or modification of query results when the Kylin service operates in its most common query‑only mode. The weakness is identified as CWE-89.

The flaw exists in Apache Kylin versions from 4.0.0 up to and including 5.0.4. The affected product is the Apache Software Foundation’s Apache Kylin. The default and most widely deployed configuration is a query‑only service, which is the environment typically targeted.

The vulnerability has a disclosed CVSS score of 5.3, and the EPSS score is < 1%, indicating a low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker sending crafted table or name parameters to the Kylin query endpoint. Because the service accepts user‑supplied strings in a query context, exploitation would require network access to the Kylin API. The impact is considered moderate when the service is in query‑only mode, reflecting the limited scope of damage compared to a full‑mode deployment.