Apache Kylin 4.0.4 through 5.0.4 has an authentication bypass that can be reached from the in-house network. An unauthenticated attacker on that network can trigger an unauthenticated metadata broadcast. Impact is greatest when Kylin services are exposed directly to the public internet, which the vendor says is uncommon; typical in-house deployments are mostly not affected. The flaw is not listed in CISA KEV and no public proof-of-concept is known. Users should upgrade to 5.0.5.
What to do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services to the public internet and restrict in-house network access to trusted hosts only.
Affected
Apache Software Foundation Apache Kylin
4.0.4 through 5.0.4
Estimated exposure
nichelikely hundreds to low thousands of deployments; publicly reachable instances uncommon — Apache Kylin is a specialized enterprise OLAP platform rather than a mass-deployed product, and the advisory states that direct public exposure is uncommon and typical in-house deployments are mostly unaffected; no public install or scan…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Apache Kylin 4.0.4 through 5.0.4 can broadcast metadata without authentication on internal networks.
Li Yang disclosed CVE-2026-108709, an authentication bypass that allows unauthenticated metadata broadcast in Apache Kylin 4.0.4 through 5.0.4. Apache rates it moderate and says impact is greatest for uncommon internet-exposed deployments; in-house installs are mostly not affected. Users are advised to upgrade to 5.0.5.