{"id":"CVE-2026-68572","kind":"vulnerability","aliases":["CVE-2026-68572"],"related":[],"title":"Apache Kylin: sensitive information exposed to unauthorized actors in 4 through 5.0.4","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4 through 5.0.4 expose sensitive information to actors who should not see it. The sources do not say which data leaks or what an attacker can do with it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","data-platform","package","self-hosted"],"not_affected_if":["version-outside-4-to-5.0.4"],"how_to_check":"- Check the installed Apache Kylin version and see whether it falls in the range `4` through `5.0.4`\n- unknown","fix":"- Upgrade Apache Kylin to `5.0.5`","status":"open","published_at":"2026-10-16T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:55+00:00","updated_at":"2026-10-25T03:24:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:24:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`","reach":"unknown","title":"Apache Kylin: sensitive information exposed to unauthorized actors in 4 through 5.0.4","impact":"medium","summary":"Apache Kylin versions 4 through 5.0.4 expose sensitive information to actors who should not see it. The sources do not say which data leaks or what an attacker can do with it.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","data-platform"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive information readable by unauthorized actors; exact data unknown","analyst_note":"Find the NVD or Apache mailing list advisory to learn which information leaks and whether authentication is required.","how_to_check":"- Check the installed Apache Kylin version and see whether it falls in the range `4` through `5.0.4`\n- unknown","needs_analyst":true,"not_affected_if":["version-outside-4-to-5.0.4"],"who_is_affected":"Teams running Apache Kylin 4 through 5.0.4 are affected. The sources do not describe the data path or configuration that exposes the information, so teams on other versions can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000565,"input_tokens":3307,"output_tokens":468,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-68572':15A,18A '4':10A,32B,75C '5.0.4':12A,34B,77C '5.0.5':85C 'actor':8A,39B,64C 'affect':71C 'apach':1A,20B,29B,67C,72C 'apache-kylin':19B 'attack':56B 'cve':13A,16A 'data':23B,51B 'data-platform':22B 'expos':5A,35B 'exposur':57C 'fix':87C 'host':28B 'inform':4A,37B,60C 'issu':70C,89C 'kylin':2A,21B,30B,68C,73C 'leak':52B 'packag':25B 'platform':24B 'recommend':80C 'say':49B 'see':43B 'self':27B 'self-host':26B 'sensit':3A,36B,59C 'sourc':46B 'unauthor':7A,63C 'upgrad':82C 'user':78C 'version':31B,84C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Kylin 4 through 5.0.4 are affected. The sources do not describe the data path or configuration that exposes the information, so teams on other versions can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68572","severity":null,"published_at":"2026-10-16T20:17:24+00:00","modified_at":"2026-10-20T18:17:21+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}