CVE-2026-68573criticalCWE-287

CVE-2026-68573: critical vulnerability in Apache Kylin

Apache Kylin: Unauthenticated Metastore Cleanup

Published · Updated

Follow this CVE+ Monitor Apache Kylin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.5%
Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Kylin
Related CVEs — Apache Kylin

In the same product, most dangerous first.

CVE-2021-45456—Command injectionEPSS 88.9%CVE-2022-24697CRITICALApache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersEPSS 84.8%CVE-2022-43396HIGHApache Kylin: Command injection by Useless configurationEPSS 55.3%CVE-2025-61734HIGHApache Kylin: improper restriction of file readEPSS 28.8%CVE-2022-44621CRITICALApache Kylin: Command injection by Diagnosis ControllerEPSS 3.1%CVE-2021-31522—Apache Kylin unsafe class loadingEPSS 3.0%