Apache Kylin allows special parameters within the JDBC URL to bypass whitelist verification, which results in improper control of code generation—an injection flaw. An attacker who can influence the JDBC URL may inject arbitrary code, leading to compromise of the Kylin service. The vulnerability primarily threatens Kylin instances that are directly exposed to a public network; internal, isolated deployments are unlikely to be affected. The weakness is classified as CWE‑94, indicating code injection rather than simple input validation error.

The flaw affects Apache Kylin versions 4.x and 5.0.4. Users running any release within this range that accepts JDBC URLs from external sources are vulnerable. Version 5.0.5 and later contain a fix that restores proper whitelist enforcement and removes the injection vector.

The CVSS score is 8.8, indicating a high severity potential, especially for exposed services. The EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote, requiring the attacker to supply a malicious JDBC URL to an accessible Kylin endpoint. The impact depends on network exposure; unprotected public deployments pose a high risk, while internal deployments provide limited exposure.