CVE-2020-13937: Apache Kylin REST API exposes configuration without authentication

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is trivially exploitable without authentication and has a very high EPSS score, though CVSS rates the direct impact as medium and there is no KEV listing.

What it is

Apache Kylin ships a RESTful API endpoint that returns the server's configuration information without requiring any authentication. Because configuration files often contain credentials, connection strings and other confidential entries, any network-reachable instance leaks sensitive data to unauthenticated users. The flaw affects a long list of Kylin releases from 2.0.0 through 4.0.0-alpha.

Impact

An unauthenticated attacker gains read access to Kylin configuration data, which can include credentials and internal system details useful for follow-on attacks. The direct impact is confidentiality loss only; there is no integrity or availability effect.

Attack surface

Reachable over the network via the Kylin REST API (CVSS vector AV:N/PR:N/UI:N), so no authentication and no user interaction are required. Any host exposing the Kylin web service is a candidate.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.783 probability, 99.6th percentile), indicating elevated likelihood of exploitation activity. The only references are the Apache vendor advisory and release notes; no public exploit code is cited in the record.

What to do

• Upgrade Apache Kylin to a release that fixes the unauthenticated configuration API; consult the Apache Kylin advisory for the fixed version.
• If upgrade is not immediately possible, restrict network access to the Kylin REST API to trusted hosts using firewall rules or a reverse proxy.
• Require authentication at the fronting proxy for all Kylin API paths, especially configuration endpoints.
• Rotate any credentials or secrets that may have been stored in Kylin configuration and exposed.
• Monitor Kylin configuration files for plaintext secrets and move them to a secrets manager.

Detection

• Search web/proxy logs for unauthenticated requests to Kylin configuration API paths and flag any that return HTTP 200.
• Baseline which clients normally call the Kylin REST API and alert on new or external source IPs hitting configuration endpoints.
• Inspect Kylin configuration responses for secret-like values and alert if such endpoints are reachable from untrusted networks.
• Use network monitoring to detect scanning or enumeration of Kylin API paths from outside expected segments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.