One restful api in Apache Kylin exposes Kylin’s configuration information without authentication, which is dangerous because some confidential information entries will be exposed to everyone.