CVE-2026-69076None▾ SunlitExposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. Th…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4..0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69080NoneApache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-68572NoneApache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-69077NoneApache Kylin: JobController allows unauthorized cross-project manipulation
CVE-2026-63618High· 7.5Apache Kylin: Low-Privilege Config Exposure
CVE-2026-108743NoneApache Kylin: spark job OS command injection
CVE-2026-108709NoneApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)