The vulnerability allows an unauthorized actor to access the query SQL blacklist in Apache Kylin, which contains potentially sensitive data about blocked queries. This disclosure breaches data confidentiality, revealing internal security policies or structural information. The weakness is identified as CWE-200.

Apache Kylin versions 4.x through 5.0.4 are vulnerable. The vendor is the Apache Software Foundation. The affected component is the QuerySQLBlacklistController within the REST API. Users should upgrade to 5.0.5 or later to remediate.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no documented exploits. However, the vulnerability can be triggered by anyone who can reach the Kylin service, making it a potential risk for environments with exposed services. The lack of public exploitation evidence reduces immediate threat, but the information exposure could still aid attackers in planning further attacks.