CVE-2026-68573

Received Received - Intake

Improper Authentication in Apache Kylin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-68573

EUVD

EUVD-2026-103148

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Kylin 4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is an Improper Authentication vulnerability in Apache Kylin. It allows unauthenticated users to access system cleanup actions. The impact is most significant for Kylin services directly exposed to public networks, which is uncommon. In-house deployments are typically not affected.

Detection Guidance

To detect this vulnerability, check if your Apache Kylin version is between 4.0 and 5.0.4. Run: kylin.sh version or check the version in the web UI. Verify if cleanup actions are accessible without authentication by inspecting network logs for unauthorized POST requests to cleanup endpoints.

Impact Analysis

Unauthenticated users could perform system cleanup actions, potentially disrupting services or causing data loss. This is mainly a risk for publicly exposed Kylin services, not typical in-house setups.

Compliance Impact

The vulnerability allows unauthenticated users to access system cleanup actions, which could lead to unauthorized data deletion or modification. This may violate data integrity and access control requirements under GDPR and HIPAA, especially if the Kylin service is exposed to public networks.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later immediately. If upgrading is not possible, restrict network access to Kylin services to prevent public exposure. Review and enforce authentication for all administrative actions.

Hi! I’m here to help you understand CVE-2026-68573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70