CVE-2026-108833: Apache Kylin: default startup profile miss security settings
Apache Kylin’s default startup profile omits security settings in versions 4.0.0 through 5.0.4.
CVE-2026-108833 affects Apache Kylin 4.0.0 through 5.0.4 because the default startup profile omits security settings. Deployments that explicitly enable the security-settings profile are not affected. Apache rates it low and recommends upgrading to 5.0.5; it is tracked as KYLIN-6113.
18