Apache Kylin versions 4.0.0 through 5.0.4 contain a potential JDBC source configuration validation issue. The flaw can allow an attacker to provide or alter JDBC source definitions that are insufficiently checked, leading to misconfiguration of database connections. The impact is described as minor unless the Kylin backend services are accessible from a public network, in which case an attacker could use the vulnerability to gain unintended access to the underlying database or alter its configuration.

Affected products include Apache Kylin by the Apache Software Foundation. Versions vulnerable are every release from 4.0.0 up to and including 5.0.4.

A public EPSS score is not available and the vulnerability is not listed in CISA KEV. Despite this, the issue is exploitable for configuration tampering if an attacker can reach the Kylin service endpoint. The attack vector is inferred to be remote, via the web service that accepts JDBC configuration requests. Exploitation would require the attacker to send crafted configuration data to the service, which would then be accepted without proper validation, potentially exposing internal database details or allowing unauthorized connections. Given the requirement of network access to the backend, the risk level is moderate when exposed publicly but low within a secured internal environment.