{"id":"CVE-2026-63618","kind":"vulnerability","aliases":["CVE-2026-63618"],"related":[],"title":"Apache Kylin: system configuration info exposed to unauthorized users","description":"Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4 through 5.0.4 expose system-level configuration information to actors who should not see it. An attacker who can reach the service may read sensitive settings that help with further attacks.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","package","self-hosted"],"not_affected_if":["version-5.0.5-or-later"],"how_to_check":"- Check the installed Kylin version and see whether it falls within 4 through 5.0.4.\n- unknown","fix":"- Upgrade Apache Kylin to `5.0.5`.","status":"open","published_at":"2026-10-16T13:16:57+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:25:05+00:00","updated_at":"2026-10-25T03:25:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:25:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`.","reach":"unknown","title":"Apache Kylin: system configuration info exposed to unauthorized users","impact":"medium","summary":"Apache Kylin versions 4 through 5.0.4 expose system-level configuration information to actors who should not see it. An attacker who can reach the service may read sensitive settings that help with further attacks.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Unauthorized users read system configuration details.","analyst_note":"Find the advisory and identify which endpoints leak configuration and whether authentication is required.","how_to_check":"- Check the installed Kylin version and see whether it falls within 4 through 5.0.4.\n- unknown","needs_analyst":true,"not_affected_if":["version-5.0.5-or-later"],"who_is_affected":"Teams running Apache Kylin from version 4 through 5.0.4 are affected. The sources do not say which endpoints expose the data or which configurations are needed, so exposure depends on whether the instance is reachable by untrusted users. Teams on 5.0.5 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000567,"input_tokens":3320,"output_tokens":469,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-63618':12A,15A '4':26B,80C '5.0.4':28B,82C '5.0.5':90C 'actor':36B,69C 'affect':76C 'apach':1A,17B,23B,72C,77C 'apache-kylin':16B 'attack':43B,57B 'configur':4A,33B,64C 'cve':10A,13A 'expos':6A,29B 'exposur':58C 'fix':92C 'help':54B 'host':22B 'info':5A,65C 'inform':34B,61C 'issu':75C,94C 'kylin':2A,18B,24B,73C,78C 'level':32B,63C 'may':49B 'packag':19B 'reach':46B 'read':50B 'recommend':85C 'see':40B 'self':21B 'self-host':20B 'sensit':51B,60C 'servic':48B 'set':52B 'system':3A,31B,62C 'system-level':30B 'unauthor':8A,68C 'upgrad':87C 'user':9A,83C 'version':25B,89C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Kylin from version 4 through 5.0.4 are affected. The sources do not say which endpoints expose the data or which configurations are needed, so exposure depends on whether the instance is reachable by untrusted users. Teams on 5.0.5 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63618","severity":null,"published_at":"2026-10-16T13:16:57+00:00","modified_at":"2026-10-16T15:20:39+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}