CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement
Apache Kylin 4.0.0–5.0.4 may allow unauthenticated replacement of job metadata if services are exposed.
CVE-2026-108823 is a moderate-severity flaw in Apache Kylin 4.0.0 through 5.0.4 that can allow unauthenticated replacement of job metadata and exposure of sensitive information. Apache says the impact is minor unless job services are exposed to a public network, which it describes as uncommon. Users should upgrade to 5.0.5; exploitation is not reported.
36