CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup
Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kylinto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Apache Kylin services directly exposed to the public network are most affected. In-house deployments are described as mostly not impacted.
What access does an attacker need to exploit it?
An unauthenticated user can access system cleanup actions, so exploitation does not require authentication. Exposure depends on the Kylin service being reachable by the attacker.
Which versions should be remediated, and what is the fix?
Apache Kylin versions from 4 through 5.0.4 are affected. Upgrade to version 5.0.5, which fixes the issue.