The vulnerability is a SQL Injection flaw in Apache Kylin's handling of table and name inputs used within SparkSQL queries. Because the application fails to properly escape or validate these inputs, an attacker could inject arbitrary SQL statements. This could allow unauthorized access, data disclosure, or modification of query results when the Kylin service operates in its most common query‑only mode. The weakness is identified as CWE‑89.

The flaw exists in Apache Kylin versions from 4.0.0 up to and including 5.0.4. The affected product is the Apache Software Foundation’s Apache Kylin. The default and most widely deployed configuration is a query‑only service, which is the environment typically targeted.

The vulnerability has no disclosed CVSS score, and the EPSS score is not available, indicating there is no public data on exploitation likelihood at this time. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker sending crafted table or name parameters to the Kylin query endpoint. Because the service accepts user‑supplied strings in a query context, exploitation would require network access to the Kylin API. The impact is considered moderate when the service is in query‑only mode, reflecting the limited scope of damage compared to a full‑mode deployment.