CVE-2026-63618
Apache Kylin low-privilege users can read system configuration
CVE-2026-63618 exposes system-level configuration information to an unauthorized actor in Apache Kylin 4 through 5.0.4. CISA ADP scores it CVSS 3.1 7.5 in NVD. Apache rates it important. Fixed in 5.0.5. Not in CISA KEV as of check.
By ThreatWire Desk · Published 16 Oct 2026 · Updated 19 Oct 2026
- CVSS
- 7.5
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Class
- Info disclosure
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Apache
- Products
- Apache Kylin
- Affected
- Apache Kylin 4 through 5.0.4.
- Fixed
- Apache Kylin 5.0.5, per the Apache announcement of 16 October 2026.
- CWE
- CWE-200
- Published
- 16 Oct 2026
- Updated
- 19 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-63618 is an information exposure flaw in Apache Kylin. Apache announced it on 16 October 2026 under the title "Low-Privilege Config Exposure".
Apache says system-level configuration information is exposed to an unauthorized actor. It affects Kylin 4 through 5.0.4. It is fixed in Kylin 5.0.5.
Apache rates it important. NVD lists CVSS 3.1 7.5 (High), a score added by CISA ADP. The record was still awaiting analysis in NVD on 18 October 2026.
The CVE is not in the CISA KEV catalog as of 19 October 2026. No exploitation and no public PoC have been reported. ThreatWire found none.
It is one of 21 Kylin CVEs fixed in 5.0.5. See the ThreatWire article on the release for the full list.
What to do: upgrade to Kylin 5.0.5.