CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard
Apache Kylin 4 through 5.0.4 allows unauthorized actors to discard jobs across projects; fixed in 5.0.5.
Apache disclosed CVE-2026-69076, rated important, in Apache Kylin versions 4 through 5.0.4. The flaw exposes job-discard operations to an unauthorized actor across projects. Impact is described as mainly relevant to the uncommon case of Kylin services exposed directly to the public network. Version 5.0.5 fixes the issue, and no in-the-wild exploitation is stated.
- CVE-2026-69076 affects Apache Kylin 4 through 5.0.4.
- Unauthorized actors can discard jobs across projects.
- Severity is important, but public exposure is uncommon.
- Fixed in Apache Kylin 5.0.5.
Vulnerabilities mentionedAll →
- Unauthorized job discard in Apache Kylinpublished · Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-69076 | Unauthorized job discard in Apache Kylin Apache Kylin versions 4 through 5.0.4 allow an unauthorized actor to discard jobs, including across projects. The issue matters most when Kylin services are reachable from the public internet, which Apache says is not a common deployment. Typical in-house deployments are mostly not impacted. An attacker who can reach the service may discard jobs they are not authorized to manage, disrupting analytics workloads. There is no known public proof of concept and no report of exploitation in the wild; the fix is version 5.0.5. Do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services to the public internet and restrict job-management APIs to trusted users and networks. Review recent job discards for unexpected cross-project actions. | — |
Posted by Li Yang on Oct 15 Severity: important Affected versions: - Apache Kylin 4..0.0 through 5.0.4 Description: Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the...
This source does not provide full text. Read it at seclists.org.