CVE-2026-108766: Apache Kylin: missing JDBC-config authorization
Apache Kylin 4.0.0 through 5.0.4 lacks JDBC-config authorization; users should upgrade to 5.0.5.
A moderate-severity flaw, CVE-2026-108766, affects Apache Kylin 4.0.0 through 5.0.4. Missing authorization allows updates to JDBC source configuration. Impact is greatest when Kylin is exposed to the public internet, which the project says is uncommon; typical in-house deployments are mostly unaffected. Users are advised to upgrade to 5.0.5.
- CVE-2026-108766 is a moderate missing-authorization flaw in Apache Kylin.
- Affected releases are 4.0.0 through 5.0.4; 5.0.5 fixes it.
- Risk is highest when Kylin is exposed to the public internet.
- Typical in-house deployments are mostly not impacted.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108766 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue....
This source does not provide full text. Read it at seclists.org.