CVE-2026-69076

{
  "etk_id": "ETK-2026-2026",
  "cve_id": "CVE-2026-69076",
  "display_id": "CVE-2026-69076",
  "ghsa_id": "GHSA-8x2p-cwp9-gghm",
  "euvd_id": "EUVD-2026-103149",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthorized job discard in Apache Kylin",
  "summary": "Apache Kylin versions 4 through 5.0.4 have an authorization flaw in job-discard handling. An attacker who can reach an affected service may cancel jobs, including jobs associated with projects they are not permitted to manage. Publicly exposed Kylin deployments face the greatest exposure.",
  "mitigation": "Upgrade Apache Kylin to version 5.0.5. Until upgraded, restrict network access to Kylin services and avoid exposing them directly to the public internet.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Kylin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4..0.0, <= 5.0.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Kylin",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 7.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.002,
  "epss_percentile": 0.0891,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 90.6007839,
  "t0_at": "2026-10-16T19:32:39.538000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-16T19:32:39.538000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T19:32:39.538000+00:00",
      "url": "https://github.com/advisories/GHSA-8x2p-cwp9-gghm"
    }
  }
}