{"id":"CVE-2026-68573","kind":"vulnerability","aliases":["CVE-2026-68573"],"related":[],"title":"Improper Authentication vulnerability in Apache Kylin","description":"Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. \n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4 through 5.0.4 have an authentication flaw that lets an unauthenticated user trigger system cleanup actions. An attacker who can reach a Kylin service can make it delete or clean up its own data or metadata without logging in.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","big-data","package","self-hosted"],"not_affected_if":["in-house-only-deployment","not-publicly-exposed","version-5.0.5-or-later"],"how_to_check":"Check the installed Kylin version (Kylin 4.x through 5.0.4 are affected).","fix":"Upgrade Apache Kylin to version 5.0.5.\nRestrict network access to Kylin services so they are not directly exposed to the public internet.","status":"open","published_at":"2026-10-16T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:04:56+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:04:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Kylin to version 5.0.5.\nRestrict network access to Kylin services so they are not directly exposed to the public internet.","reach":"internet","impact":"high","summary":"Apache Kylin versions 4 through 5.0.4 have an authentication flaw that lets an unauthenticated user trigger system cleanup actions. An attacker who can reach a Kylin service can make it delete or clean up its own data or metadata without logging in.","category":"package","who_cares":["apache-kylin","self-hosted","big-data"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker triggers system cleanup actions on the Kylin service","analyst_note":"Check the NVD entry and Apache Kylin security advisory for exact cleanup actions affected and any workaround besides upgrading; the sources do not state the data loss scope.","how_to_check":"Check the installed Kylin version (Kylin 4.x through 5.0.4 are affected).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["in-house-only-deployment","not-publicly-exposed","version-5.0.5-or-later"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000501,"input_tokens":2803,"output_tokens":442,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':8A,11A '-68573':9A,12A '4':26B,110C '5.0.4':28B,112C '5.0.5':120C 'access':73C 'action':41B,77C 'affect':106C 'apach':5A,14B,23B,68C,107C 'apache-kylin':13B 'attack':43B 'authent':2A,31B,65C 'big':17B 'big-data':16B 'clean':55B 'cleanup':40B,76C 'common':94C 'cve':7A,10A 'data':18B,59B 'delet':53B 'deploy':99C 'direct':86C 'expos':87C 'fix':122C 'flaw':32B 'host':22B 'hous':97C 'impact':78C,103C 'improp':1A,64C 'in-hous':95C 'issu':105C,124C 'kylin':6A,15B,24B,48B,69C,82C,98C,108C 'let':34B 'log':63B 'make':51B 'may':72C 'metadata':61B 'most':101C 'network':90C 'packag':19B 'public':89C 'reach':46B 'recommend':115C 'self':21B 'self-host':20B 'servic':49B,83C 'system':39B,75C 'trigger':38B 'unauthent':36B,70C 'upgrad':117C 'user':37B,71C,113C 'version':25B,119C 'vulner':3A,66C 'without':62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68573","severity":null,"published_at":"2026-10-16T20:17:24+00:00","modified_at":"2026-10-20T18:17:21+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}