Live › vulnerability › CVE-2026-63618
Go to dashboardApache Kylin versions 4 through 5.0.4 expose system-level configuration information to actors who should not see it. An attacker who can reach the service may read sensitive settings that help with further attacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Kylin from version 4 through 5.0.4 are affected. The sources do not say which endpoints expose the data or which configurations are needed, so exposure depends on whether the instance is reachable by untrusted users. Teams on 5.0.5 or later are not affected.
No product ranges from the sources yet.
5.0.5.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-63618")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.