CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation

Q: Which deployments are most exposed?

Apache Kylin services directly exposed to the public network are most impacted. The available information states that in-house Kylin deployments are mostly not impacted.

Q: What versions should be remediated?

Apache Kylin versions from 4 through 5.0.4 are affected. Upgrade to version 5.0.5, which fixes the issue.

Published Oct 16, 2026

Updated

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=4<=5.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Event History

Oct 16, 2026

CVE Published

via MITRE·07:33 PM

Data Sourced

via MITRE·07:33 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are most exposed?

Apache Kylin services directly exposed to the public network are most impacted. The available information states that in-house Kylin deployments are mostly not impacted.

What versions should be remediated?