CVE-2026-69077

Received Received - Intake

Unauthorized Job Manipulation in Apache Kylin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-69077

EUVD

EUVD-2026-103150

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Kylin 4..0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is an unauthorized cross-project job manipulation vulnerability in Apache Kylin. It allows attackers to manipulate jobs across projects without proper authorization. The impact is most significant for Kylin services directly exposed to the public internet, which is uncommon in typical deployments.

Detection Guidance

To detect this vulnerability, check if your Apache Kylin version is between 4.0 and 5.0.4. Run: kylin.sh version or check the version in the web UI. If exposed to the public network, inspect for unauthorized cross-project job manipulations.

Impact Analysis

If your Kylin service is exposed to the public internet, attackers could manipulate jobs across projects, potentially leading to unauthorized data access or system disruption. Most in-house deployments are not affected as they are not publicly accessible.

Compliance Impact

The vulnerability involves unauthorized cross-project job manipulation in Apache Kylin, which could allow attackers to alter jobs exposed to public networks. This may lead to data integrity issues or unauthorized access, potentially violating compliance requirements for GDPR or HIPAA if sensitive data is involved.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later immediately. If using an in-house deployment not exposed to the public network, no action is required as the impact is minimal.

Hi! I’m here to help you understand CVE-2026-69077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70