{"id":"CVE-2026-69076","kind":"vulnerability","aliases":["CVE-2026-69076"],"related":[],"title":"Apache Kylin: unauthorized users can discard jobs on exposed servers","description":"Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4 through 5.0.4 let an unauthorized actor discard jobs because the job discard action is not properly access-checked. An attacker who can reach a publicly exposed Kylin service can stop or remove its build jobs.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","data-pipelines","package","self-hosted"],"not_affected_if":["internal-network-only","patched-5.0.5"],"how_to_check":"- Check the installed Kylin version and whether it falls between `4.x` and `5.0.4`\n- Confirm whether the Kylin web or REST service is reachable from the public internet","fix":"- Upgrade Apache Kylin to `5.0.5`\n- Keep Kylin off the public network until upgraded","status":"open","published_at":"2026-10-16T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:54+00:00","updated_at":"2026-10-25T03:24:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:24:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`\n- Keep Kylin off the public network until upgraded","reach":"internet","title":"Apache Kylin: unauthorized users can discard jobs on exposed servers","impact":"low","summary":"Apache Kylin versions 4 through 5.0.4 let an unauthorized actor discard jobs because the job discard action is not properly access-checked. An attacker who can reach a publicly exposed Kylin service can stop or remove its build jobs.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","data-pipelines"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Unauthorized users can discard running or queued Kylin jobs","analyst_note":"","how_to_check":"- Check the installed Kylin version and whether it falls between `4.x` and `5.0.4`\n- Confirm whether the Kylin web or REST service is reachable from the public internet","needs_analyst":false,"not_affected_if":["internal-network-only","patched-5.0.5"],"who_is_affected":"Only Kylin services directly exposed to the public network are at meaningful risk, according to the sources. In-house deployments reachable only from internal networks are mostly not impacted. Teams running Kylin 4 through 5.0.4 behind a firewall can prioritise the upgrade lower.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000592,"input_tokens":3347,"output_tokens":514,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-69076':13A,16A '4':30B,111C '5.0.4':32B,113C '5.0.5':121C 'access':48B 'access-check':47B 'action':43B 'actor':36B,74C 'affect':107C 'apach':1A,18B,27B,77C,108C 'apache-kylin':17B 'attack':51B 'build':65B 'check':49B 'common':95C 'cve':11A,14A 'data':21B 'data-pipelin':20B 'deploy':100C 'direct':87C 'discard':6A,37B,42B,70C 'expos':9A,57B,88C 'exposur':67C 'fix':123C 'host':26B 'hous':98C 'impact':79C,104C 'in-hous':96C 'issu':106C,125C 'job':7A,38B,41B,66B,69C 'kylin':2A,19B,28B,58B,78C,83C,99C,109C 'let':33B 'most':102C 'network':91C 'packag':23B 'pipelin':22B 'proper':46B 'public':56B,90C 'reach':54B 'recommend':116C 'remov':63B 'self':25B 'self-host':24B 'server':10A 'servic':59B,84C 'stop':61B 'unauthor':3A,35B,73C 'upgrad':118C 'user':4A,114C 'version':29B,120C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Only Kylin services directly exposed to the public network are at meaningful risk, according to the sources. In-house deployments reachable only from internal networks are mostly not impacted. Teams running Kylin 4 through 5.0.4 behind a firewall can prioritise the upgrade lower.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69076","severity":null,"published_at":"2026-10-16T20:17:24+00:00","modified_at":"2026-10-20T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}