Apache Kylin ships with a default startup profile that fails to enable essential security settings such as authentication and authorization. When an organization deploys Kylin using this default profile without activating the security setting profile, the service is effectively left unprotected and can be accessed by any client connected to the network. The resulting weakness is improper access control that allows unauthorized users to query the service and gain visibility into the underlying data without needing valid credentials.

Apache Kylin versions from 4.0.0 through 5.0.4 are impacted when the default startup profile is used. Deployments that explicitly enable the security setting profile are not affected, as the profile applies the necessary safeguards.

The vulnerability receives a CVSS score of 7.5, indicating a high severity. The EPSS score is under 1%, suggesting a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker only requires network connectivity to the Kylin instance to exploit the missing configuration. Because the flaw originates from a missing security default rather than an application bug, an unauthenticated attacker can obtain unauthorized access, potentially exposing sensitive data stored in the cluster.