AI analysis
Apache Kylin versions 4 through 5.0.4 allow an unauthorized actor to discard jobs, including across projects. The issue matters most when Kylin services are reachable from the public internet, which Apache says is not a common deployment. Typical in-house deployments are mostly not impacted. An attacker who can reach the service may discard jobs they are not authorized to manage, disrupting analytics workloads. There is no known public proof of concept and no report of exploitation in the wild; the fix is version 5.0.5.
What to do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services to the public internet and restrict job-management APIs to trusted users and networks. Review recent job discards for unexpected cross-project actions.
Affected
| Apache Kylin | 4 through 5.0.4 |
Estimated exposure
nicheunknown (publicly reachable instances described as uncommon) — Apache states that Kylin services exposed directly to the public internet are uncommon and that typical in-house deployments are mostly not impacted; no public install or internet-scan counts are available.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.