Apache Kylin contains a flaw where a backend metadata dump API does not enforce sufficient authorization or restrict the requested file paths. This omission allows attackers who can contact the API endpoint to retrieve raw system metadata, potentially exposing sensitive configuration data and internal structure. The vulnerability can lead to an unwanted disclosure of information useful for further attacks.

This issue affects Apache Kylin versions 4 through 5.0.4. The Apache Software Foundation distributes the affected product, and users running these versions are potentially exposed.

The EPSS score is not available and Kylin is not listed in the CISA KEV catalog, indicating that there is currently no evidence of widespread exploitation. The absence of a public-facing front‑end on the Kylin service means the risk is primarily limited to environments where the meta dump endpoint is reachable from a public network. Nonetheless, if such exposure exists, an attacker could exploit the flaw remotely via the HTTP API to obtain system metadata.