CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass
Apache Kylin 4.0.0 through 5.0.4 has a moderate metadata-backup path bypass, fixed in 5.0.5.
Apache disclosed CVE-2026-108762, a moderate path-confinement bypass during metadata backup deletion in Apache Kylin. Versions 4.0.0 through 5.0.4 are affected, mainly when Kylin services are directly exposed to the public network, which Apache says is uncommon. The fix is version 5.0.5. No in-the-wild exploitation is mentioned.
32