This vulnerability enables an unauthenticated user to replace job metadata in Apache Kylin, exposing potentially sensitive configuration or query details. The flaw originates from missing authentication checks when updating job metadata, allowing an attacker to modify or overwrite data associated with existing jobs. The exposed information is limited to job metadata; there is no evidence of code execution or broader system compromise, so the impact is considered minor unless the job services are reachable from an external network.

Apache Kylin versions 4.0.0 through 5.0.4 are affected, produced by the Apache Software Foundation.

The vulnerability can be exploited only when the Kylin job services are exposed without authentication, a configuration that is uncommon but possible in public‑Internet deployments. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting that no confirmed exploitation has been observed. Nevertheless, the lack of authentication checks and the potential for public exposure make the risk moderate for exposed systems.