CVE-2026-69080

{
  "etk_id": "ETK-2026-2017",
  "cve_id": "CVE-2026-69080",
  "display_id": "CVE-2026-69080",
  "ghsa_id": "GHSA-2q75-3h97-94cq",
  "euvd_id": "EUVD-2026-103152",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthorized disclosure of SQL blacklist data in Apache Kylin",
  "summary": "Apache Kylin 4.0.0 through 5.0.4 can expose SQL blacklist information because of an authorization weakness. An attacker able to access the affected Kylin service interface may obtain that information without the intended authorization.",
  "mitigation": "Upgrade Apache Kylin to version 5.0.5. Until upgrades are complete, restrict access to the Kylin service to trusted users and networks.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Kylin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4..0.0, <= 5.0.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Kylin",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 7.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.002,
  "epss_percentile": 0.0891,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 101.73565733333334,
  "t0_at": "2026-10-16T19:37:50.174000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-19T04:13:30.692206+00:00",
      "days": 2.3581078496064816,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T19:37:50.174000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T19:37:50.174000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T19:37:50.174000+00:00",
      "url": "https://github.com/advisories/GHSA-2q75-3h97-94cq"
    }
  }
}