CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
Apache Kylin’s broadcast API lacks authentication and allows polymorphic deserialization through 5.0.4.
CVE-2026-108771 covers missing authentication on Apache Kylin’s in-house broadcast API together with polymorphic deserialization, affecting 4.0.0 through 5.0.4. Apache rates it moderate and says impact is greatest when services are exposed to the public network, which is uncommon. Typical internal deployments are mostly not affected. Users should upgrade to 5.0.5; exploitation is not reported.
40