liyang created KYLIN-6122:
-----------------------------
Summary: Potential authorization issue in query node event log
cleanup
Key: KYLIN-6122
URL: https://issues.apache.org/jira/browse/KYLIN-6122
Project: Kylin
Issue Type: Bug
Affects Versions: 5.0.5
Reporter: liyang
Assignee: liyang
Fix For: 5.0.6
The query-node event-log cleanup operation is exposed as an unauthenticated
internal API endpoint without a global administrator or internal service-token
check. A caller can trigger maintenance work without authorization.
Fix direction: require a global administrator or valid internal service
credential, and preserve the legitimate scheduler path by attaching the
deployment-scoped service credential.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
