CVE-2026-108766: Apache Kylin: missing JDBC-config authorization
Apache Kylin 4.0.0 through 5.0.4 lacks JDBC-config authorization; users should upgrade to 5.0.5.
A moderate-severity flaw, CVE-2026-108766, affects Apache Kylin 4.0.0 through 5.0.4. Missing authorization allows updates to JDBC source configuration. Impact is greatest when Kylin is exposed to the public internet, which the project says is uncommon; typical in-house deployments are mostly unaffected. Users are advised to upgrade to 5.0.5.
41