---
id: "CVE-2026-68573"
kind: "vulnerability"
aliases: ["CVE-2026-68573"]
title: "Improper Authentication vulnerability in Apache Kylin"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "big-data", "package", "self-hosted"]
not_affected_if: ["in-house-only-deployment", "not-publicly-exposed", "version-5.0.5-or-later"]
published_at: "2026-10-16T20:17:24+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68573", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Improper Authentication vulnerability in Apache Kylin

Apache Kylin versions 4 through 5.0.4 have an authentication flaw that lets an unauthenticated user trigger system cleanup actions. An attacker who can reach a Kylin service can make it delete or clean up its own data or metadata without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Kylin version (Kylin 4.x through 5.0.4 are affected).

## Fix

Upgrade Apache Kylin to version 5.0.5.
Restrict network access to Kylin services so they are not directly exposed to the public internet.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68573

## From the sources

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. 



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_