CVE-2026-108833: Apache Kylin: default startup profile miss security settings
Apache Kylin’s default startup profile omits security settings in versions 4.0.0 through 5.0.4.
CVE-2026-108833 affects Apache Kylin 4.0.0 through 5.0.4 because the default startup profile omits security settings. Deployments that explicitly enable the security-settings profile are not affected. Apache rates it low and recommends upgrading to 5.0.5; it is tracked as KYLIN-6113.
- The default startup profile omits expected security settings.
- Deployments that enable the security profile are unaffected.
- The issue is fixed in Apache Kylin 5.0.5.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108833 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Li Yang on Oct 15 Severity: low Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. This issue is being tracked as KYLIN-6113 Credit: Hari (Harikrishna KP) (finder)...
This source does not provide full text. Read it at seclists.org.