CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation
Apache Kylin 4 through 5.0.4 lets unauthorized users manipulate jobs across projects; upgrade to 5.0.5.
Apache disclosed CVE-2026-69077, an important authorization flaw in Apache Kylin JobController affecting versions 4 through 5.0.4. An unauthorized actor can manipulate jobs across projects. The project says impact is greatest for uncommon internet-exposed deployments and that typical in-house installs are mostly unaffected. Users should upgrade to 5.0.5. No exploitation is reported.
- CVE-2026-69077 affects Apache Kylin 4 through 5.0.4.
- JobController permits unauthorized cross-project job manipulation.
- Vendor rates it important; public exposure is uncommon.
- Upgrade to Apache Kylin 5.0.5.
Vulnerabilities mentionedAll →
- Unauthorized cross-project job manipulation in Apache Kylinpublished · Apache Software Foundation Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-69077 | Unauthorized cross-project job manipulation in Apache Kylin Apache Kylin versions 4 through 5.0.4 have an unauthorized cross-project job manipulation flaw in JobController, tracked as an exposure of information or actions to an unauthorized actor. It is triggered when a caller who should not control another project can manipulate that project's jobs through the job controller. The impact is greatest for Kylin services reachable directly from the public internet, which the vendor says is uncommon; typical in-house deployments are mostly not affected. Apache recommends upgrading to 5.0.5, which fixes the issue. No public proof of concept is known, and the flaw is not listed in CISA KEV. Do: Upgrade Apache Kylin to 5.0.5. Until upgraded, do not expose Kylin services directly to the public internet, and restrict access to job management so only trusted users and networks can reach it. If an instance was internet-reachable, review recent cross-project job changes for unauthorized manipulation. |
Posted by Li Yang on Oct 15 Severity: important Affected versions: - Apache Kylin 4..0.0 through 5.0.4 Description: Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which...
This source does not provide full text. Read it at seclists.org.