CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup

Apache Kylin versions 4 through 5.0.4 have an improper authentication flaw (CWE-287) that lets an unauthenticated user reach system cleanup actions, described in related reporting as unauthenticated metastore cleanup. The issue is triggered by calling those cleanup functions without authenticating, so anyone who can reach an exposed Kylin service can invoke them. That can disrupt or remove metastore and system state rather than granting a documented remote code execution path. Impact is greatest for Kylin services placed directly on the public network, which the vendor says is uncommon; typical in-house deployments are mostly not affected. There is no known public proof of concept, the CVE is not on the CISA KEV list, and exploitation in the wild is not known.

Do: Upgrade Apache Kylin to 5.0.5 or later. Until then, do not expose Kylin services directly to the public internet, and restrict access to trusted networks and authenticated users only. Review logs for unauthenticated calls to system or metastore cleanup actions.