Apache Kylin versions 4.0.0 through 5.0.4 have a vulnerability where the default startup profile lacks certain security settings. Deployments that have security setting profiles explicitly enabled are not affected. The issue is resolved in version 5.0.5.