Apache Kylin suffers from an improper authentication flaw that allows an unauthenticated user to invoke metastore cleanup operations. By gaining access to these privileged actions an attacker could delete or modify critical data structures, potentially causing data loss or corruption. The weakness is classified as CWE‑287, indicating a failure to enforce authentication before performing sensitive actions.

Affected are Apache Kylin versions from 4.0 up through 5.0.4. Systems running these versions, particularly those that expose Kylin services directly to the public network, are at risk; in‑house deployments that are internally protected are less likely to be impacted.

The CVE has a CVSS score of 9.8, an EPSS score of < 1%, and is not included in the CISA KEV catalog, so the exploitation likelihood is uncertain. However, because the flaw permits unauthenticated access to critical cleanup endpoints, any Kylin instance reachable from the Internet presents a high attack surface. If an attacker can reach the service, the vulnerability can likely be exploited without additional prerequisites, suggesting a significant risk to confidentiality and integrity of the metastore.