---
id: "CVE-2026-69076"
kind: "vulnerability"
aliases: ["CVE-2026-69076"]
title: "Apache Kylin: unauthorized users can discard jobs on exposed servers"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "data-pipelines", "package", "self-hosted"]
not_affected_if: ["internal-network-only", "patched-5.0.5"]
published_at: "2026-10-16T20:17:24+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:24:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69076", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Apache Kylin: unauthorized users can discard jobs on exposed servers

Apache Kylin versions 4 through 5.0.4 let an unauthorized actor discard jobs because the job discard action is not properly access-checked. An attacker who can reach a publicly exposed Kylin service can stop or remove its build jobs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kylin version and whether it falls between `4.x` and `5.0.4`
- Confirm whether the Kylin web or REST service is reachable from the public internet

## Fix

- Upgrade Apache Kylin to `5.0.5`
- Keep Kylin off the public network until upgraded

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-69076

## From the sources

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_