CVE-2026-68573None▾ SunlitImproper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployme…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4.0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108743NoneApache Kylin: spark job OS command injection
CVE-2026-108709NoneApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
CVE-2026-69080NoneApache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-69076NoneApache Kylin: Unauthorized cross-project job discard
CVE-2026-68572NoneApache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-69077NoneApache Kylin: JobController allows unauthorized cross-project manipulation