Apache Kylin versions 4.0.0 through 5.0.4 have a vulnerability due to missing authorization on JDBC source configuration updates. This flaw primarily impacts Kylin services exposed directly to public networks, which is uncommon, while typical in-house deployments are mostly unaffected. The issue is fixed in version 5.0.5.