Apache Kylin CVE-2026-68573

Exploitation requires an Apache Kylin instance (versions 4.0.0 through 5.0.4) that is directly exposed to the public network; the vendor explicitly notes this is not common and that typical in-house/internal Kylin deployments are mostly not impacted. Given PR:N/UI:N, no authentication or user interaction is needed once the service is reachable, and the attacker invokes the normally-protected system cleanup actions. The primary limiting factor is therefore network reachability/deployment posture rather than any authentication, configuration flag, or specific feature toggle - an internal-only deployment behind perimeter controls is effectively not exploitable.

The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, reflecting a fully unauthenticated, network-reachable improper-authentication flaw (CWE-287) in Apache Kylin. However, multiple real-world signals pull the practical risk substantially lower. The EPSS score is only 0.25% (15th percentile), indicating a low modeled probability of exploitation in the near term. There is no CISA KEV listing and no public exploit identified at time of analysis. Crucially, the vendor advisory itself states the impact is limited mostly to Kylin services directly exposed to the public network - which it notes is not common - and that in-house deployments are mostly not impacted. This creates a notable tension: the CVSS vector assumes AV:N/PR:N (unauthenticated network access against any instance), yet the vendor description implies real exploitability is gated on an uncommon exposed-to-internet deployment posture, so the headline 9.8 overstates risk for the typical internal deployment. There is also a plausible overstatement in the C:H impact: the flaw grants access to 'system cleanup actions,' which are inherently destructive (integrity/availability) rather than data-disclosing, so a full C:H may not be justified. Net assessment: a genuinely serious flaw for the minority of internet-exposed Kylin instances, but for most (internal) deployments this is a high-CVSS-but-lower-real-risk issue - prioritize patching for public-facing instances, schedule it routinely otherwise.

An attacker locates an Apache Kylin instance (version 4.0.0 through 5.0.4) directly exposed to the internet and, without any credentials, invokes the system cleanup actions that should require authentication. This lets them trigger destructive cleanup operations against Kylin metadata/data, degrading or disrupting the analytics service. No public exploit code is known, but the low attack complexity means a working request is straightforward to craft once the endpoint is identified.