CVE-2026-69076

Received Received - Intake

Exposure of Job Discard to Unauthorized Actor in Apache Kylin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-69076

EUVD

EUVD-2026-103149

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Kylin 4..0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability involves an exposure where an unauthorized actor can discard jobs in Apache Kylin. It primarily affects Kylin services directly exposed to the public internet, which is uncommon. Most in-house deployments are not impacted.

Detection Guidance

To detect this vulnerability, check if your Apache Kylin instance is exposed to the public network and running a vulnerable version (4.0 to 5.0.4). Verify the version using commands like 'curl http://<kylin-server>:7070/kylin/api/' or check logs for version details. Ensure no unauthorized access is possible.

Impact Analysis

If your Kylin service is exposed to the public network, an attacker could discard jobs, potentially disrupting operations. Most internal deployments are unaffected.

Compliance Impact

The vulnerability exposes job discard data to unauthorized actors, which could lead to unauthorized access to sensitive information. This may impact compliance with GDPR (data protection) and HIPAA (health data privacy) if such data is involved. However, the issue primarily affects publicly exposed Kylin services, which are uncommon in typical deployments.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later to fix the vulnerability. Check your current version with commands like kylin version or similar, then apply the upgrade.

Hi! I’m here to help you understand CVE-2026-69076. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70