EUVD-2026-104140
GHSA-f4w3-hpxf-cwrr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-exposed Kylin service
-
DeliveryAccess metadata backup deletion function
-
ExploitSupply path-traversal payload escaping confinement
-
ExecutionDelete files outside backup directory
-
ImpactDisrupt service or corrupt metadata
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires reaching the metadata backup deletion functionality of Apache Kylin and the ability to supply a path that the backup-deletion logic fails to confine, allowing deletion of files outside the intended backup location. The dominant limiting factor, per the vendor, is network exposure: the issue 'most' affects Kylin services directly exposed to the public network, which Apache states is uncommon, while in-house (non-exposed) deployments are mostly not impacted. Affected versions are limited to 4.0.0 through 5.0.4; 5.0.5 is fixed. Whether reaching the backup-deletion function requires authentication is not confirmed from the available data, as no CVSS vector was provided. |
| Impact | No CVSS vector, EPSS score, KEV listing, or public POC is present in the provided data, so most quantitative risk signals are absent and risk must be inferred from the description and vendor advisory. The vendor (Apache) rates this moderate and explicitly scopes impact: it 'most' affects Kylin services directly exposed to the public network, which it states is uncommon, and notes that typical in-house deployments are largely unaffected. This is therefore not a widespread emergency; it is a conditionally-serious flaw whose real risk is dominated by deployment exposure rather than by exploitability of the bug itself. The underlying issue - a path-confinement bypass during metadata backup deletion - implies arbitrary file deletion outside the intended backup directory, which can carry high integrity/availability impact where reachable, so an internet-exposed Kylin instance should treat this as a genuine priority while an internal-only instance can treat it as routine patching. No active exploitation or exploit code is indicated. Authentication requirements cannot be confirmed because no CVSS vector was supplied; this is a key data gap that should be clarified with the vendor before finalizing severity. |
| Exploit ScenarioDerived | An organization exposes an Apache Kylin instance (4.0.0-5.0.4) directly to the internet. An attacker reaches the metadata backup management functionality and submits a crafted path that escapes the intended backup directory, causing deletion of files outside the confinement boundary and corrupting or disabling the Kylin service. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Arbitrary file deletion outside the intended backup directory is possible in Apache Kylin 4.0.0 through 5.0.4 via a path-confinement bypass in the metadata backup deletion feature, allowing an attacker who can reach that function to delete files elsewhere on the Kylin host (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - integrity and availability impact, no confidentiality impact; PR:L indicates low-privilege authenticated access). The dominant limiting factor is exposure: Apache states the issue 'most' affects Kylin services directly reachable from the public network, which the vendor describes as uncommon, while in-house, non-exposed deployments are mostly not impacted. No public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis, and a vendor fix is available in Apache Kylin 5.0.5 (tracked as KYLIN-6105).
RemediationAI
Vendor-released patch: upgrade to Apache Kylin 5.0.5, which the ASF identifies as the fix for KYLIN-6105 (JIRA shows resolution Fixed with Fix Version 5.0.5); confirm your build actually reports 5.0.5 after upgrading, since the vulnerable range is 4.0.0 through 5.0.4. If immediate upgrade is not possible, apply exposure-based compensating controls: first, do not expose Kylin web/API endpoints and the metadata backup management functions directly to the public network - place them behind a VPN, IP allowlist, or an authenticating reverse proxy, since the vendor states that directly internet-exposed services are the ones most impacted and in-house deployments are mostly unaffected (trade-off: remote administrators and BI users lose direct access and must route through the VPN/proxy). Second, tighten access to the backup deletion capability specifically by blocking or disabling the corresponding endpoints at the proxy/WAF and restricting the metadata backup management permission to a small set of trusted administrator accounts, because the assessed vector (PR:L) indicates low-privilege authenticated access may be sufficient to reach the vulnerable function (trade-off: legitimate backup rotation and cleanup workflows break and must be performed manually or out of band; endpoint blocking can also cause errors in management UIs that call those APIs). Third, add file-integrity monitoring or audit rules on the Kylin metadata and configuration directories to detect unexpected deletions, which does not prevent exploitation but shortens detection time. These controls reduce exposure but are not equivalent to the 5.0.5 upgrade, which is the only complete fix identified; no vendor workaround or backport has been published beyond that release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Kylin is an open-source distributed analytics/OLAP engine for large-scale data, built around pre-calculated cubes, SQL-based modeling and index recommendation, a web UI, and integration with engines such as Apache Gluten for native computation. The vulnerable component is the metadata backup management functionality: when an operator deletes a metadata backup, the code resolves a user-supplied backup path and is supposed to constrain (confine) the deletion to the permitted backup location. The confinement check is insufficient and can be bypassed, so a crafted path escapes the backup root and the delete operation acts on files elsewhere on the filesystem - a destructive write/delete primitive. The CVE record supplies no CWE, but the root-cause class is a path-confinement / improper limitation of a pathname to a restricted directory weakness (the path traversal family, CWE-22); this mapping is an inference from the description, not a vendor-assigned CWE. The assessed impact profile (C:N/I:H/A:H) is consistent with deletion of data or application files that corrupts state and can degrade or take down Kylin services without directly exposing data. No CPE strings were provided in the intelligence supplied, so affected package identities (for example the specific Kylin server/artifact names) are not enumerated; scope is defined solely by the version range 4.0.0 through 5.0.4, corroborated by the ASF oss-security advisory and by JIRA KYLIN-6105 (resolution Fixed, Fix Version 5.0.5).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Network-reachable management function (AV:N); backup management typically needs an authenticated session (PR:L); arbitrary file deletion damages integrity and availability with no disclosure (C:N/I:H/A:H).
Description PRE-NVD
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB