This vulnerability is a classic SQL injection arising from missing authentication on selected cache API endpoints in Apache Kylin. An attacker who can reach these endpoints without credentials can inject arbitrary SQL, potentially granting read, modify, or delete access to the underlying database. The weakness is identified as CWE-306 (Missing Authentication) and CWE-89 (SQL Injection). The attack results in a complete loss of confidentiality and integrity for the database, and because the cache API can interact with other services, it can also contribute to denial of service if the database is overrun or corrupted.

Apache Kylin installations with versions 5.0.0 through 5.0.4. The flaw only manifests when the cache API is reachable from an external network; internal services that are not exposed to the public are not affected according to the advisory.

The CVSS score is 9.8, underscoring the high severity of the flaw, which stems from missing authentication and the ability to execute arbitrary SQL. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, yet an attacker can exploit it if the service is accessible from the internet. An attacker can exploit the flaw by sending crafted requests to the vulnerable cache endpoints, bypassing authentication and injecting malicious SQL commands. The attack surface is limited to exposed Kylin services, but the impact of exploitation is full database compromise.