CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement
Apache Kylin 4.0.0–5.0.4 may allow unauthenticated replacement of job metadata if services are exposed.
CVE-2026-108823 is a moderate-severity flaw in Apache Kylin 4.0.0 through 5.0.4 that can allow unauthenticated replacement of job metadata and exposure of sensitive information. Apache says the impact is minor unless job services are exposed to a public network, which it describes as uncommon. Users should upgrade to 5.0.5; exploitation is not reported.
- Unauthenticated job manipulation can replace job metadata.
- Apache says impact is minor unless job services are publicly exposed.
- Versions 4.0.0 through 5.0.4 are fixed by upgrading to 5.0.5.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108823 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. This issue is being tracked as...
This source does not provide full text. Read it at seclists.org.