The vulnerability in Apache Kylin versions 4 through 5.0.4 allows an unauthorized actor to execute arbitrary SQL against the underlying Spark SQL environment, exposing sensitive data. It is a case of improper information disclosure (CWE‑200) and permits attackers to read data they are not authorized to see.

Apache Kylin packages from version 4 up through 5.0.4 are affected. The flaw resides in the SQL execution service that forwards client queries to Spark SQL, so installations of these versions without additional safeguards are exposed.

The exploitation probability is not quantified (EPSS not available), and the vulnerability is not listed in CISA KEV. Although no CVSS score is given, the nature of the flaw implies that a remote attacker with access to the Kylin query interface can trigger the issue without additional authentication if the service is improperly protected. The likely attack vector is remote through the Kylin REST API or JDBC interface, and success depends on network exposure of the service.