Apache Kyuubi is a multi-tenant SQL gateway for data warehouses and lakehouses. It accepts client connections and manages engine sessions behind a shared service. A public web UI or REST surface can reveal operational metadata about those sessions even when the SQL listener is not reachable.
A count-only ZoomEye query on 2026-11-03 at 17:42:58 UTC found 35 matches for the exact title dork below, using sub_type=all, page 1, and page size 1.
title="Kyuubi"
The corresponding app="Apache Kyuubi" query returned zero. The title result may include a web UI, documentation, or another page with the product name. It does not establish that a SQL endpoint is reachable.
Kyuubi's configuration documentation lists HTTP basic authentication for the web UI and a configurable custom authentication class. Its frontend REST settings and UI controls determine whether the web surface is authenticated and how engine links are presented. The server also has non-web frontends such as Thrift, so a web exposure review cannot substitute for a network inventory of every listener.
The review should separate:
The REST or web UI listener.
The Thrift/JDBC or other SQL-facing listeners.
Backend Spark or engine services.
The authentication and authorization policy for each layer.
For a web match, record the bind address, authentication mode, and the amount of session information visible before login. For a SQL listener, record the network range, authentication mechanism, and tenant isolation. The two results should meet in the same ownership record.
The exact ZoomEye search result preserves the observation and the count scope. It is useful as a discovery lead because Kyuubi is often deployed as infrastructure and may not appear as a named business application. Compare the addresses with data-platform inventories and Kubernetes services.
A Kyuubi web page is not proof that an attacker can execute queries. It is proof that a title matched. The next step is a controlled verification of the actual listener and authentication boundary. The useful conclusion is a product owner, a port inventory, and an enforcement check, not a count alone.