Apache Kylin CVE-2026-69076

Exploitation requires the Apache Kylin service (versions 4 through 5.0.4) to be directly exposed to the public/untrusted network with its job-management endpoint reachable by unauthenticated clients - the vendor explicitly notes this public exposure is uncommon and that typical in-house, network-segmented deployments are mostly not impacted. The primary limiting factor is therefore deployment posture: Kylin instances behind an authenticating reverse proxy, VPN, or internal-only network are not realistically exploitable despite the PR:N vector. Upgrading to 5.0.5 removes the condition entirely.

The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw scoring 7.5, which in isolation looks like a priority issue. However, multiple corroborating signals pull the real-world risk sharply downward. EPSS is only 0.20% (9th percentile), the vulnerability is NOT listed in CISA KEV, and no public exploit code is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, the vendor description itself states that impact is limited to Kylin services directly exposed to the public network, which it explicitly calls 'not common,' and that in-house deployments are 'mostly not impacted' - meaning the PR:N/AV:N vector only fully applies to an atypical deployment posture. There is also an internal data conflict: the CWE-200 classification and CVSS C:H/I:N/A:N impact point to pure information disclosure, yet the title 'Exposure of Job Discard to an Unauthorized Actor' describes an unauthorized actor being able to discard (cancel) jobs, which reads as an integrity/availability action rather than confidentiality loss - verify the true impact with the Apache advisory. Net assessment: a genuinely high-CVSS score but a low real-world-risk issue for the typical (internal, authenticated-gateway) Kylin deployment; priority should scale with whether the Kylin UI/API is internet-exposed.

An organization exposes its Apache Kylin query/build service directly to the internet without an authentication gateway in front of it. A remote, unauthenticated attacker reaches the exposed Kylin endpoint and invokes the job-discard function (or reads job state) without authorization, affecting jobs they should not be able to access. No public proof-of-concept is referenced, and the attack only works against the uncommon publicly-exposed deployment mode.