CVE-2026-63618

7.5High

Published 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-200

Impact

Unauthenticated remote attackers can access system-level configuration information over the network. They only require network reachability to the exposed Apache Kylin service.

Root cause

An information disclosure flaw exposes sensitive system configuration data to unauthorized users.

Affected systems

Apache Kylin versions 4 through 5.0.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to Apache Kylin 5.0.5 or later. If upgrading immediately is not possible, restrict network access to the Apache Kylin service to trusted IP addresses.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-63618