CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Apache Kylin 4.0.4 through 5.0.4 can broadcast metadata without authentication on internal networks.
Li Yang disclosed CVE-2026-108709, an authentication bypass that allows unauthenticated metadata broadcast in Apache Kylin 4.0.4 through 5.0.4. Apache rates it moderate and says impact is greatest for uncommon internet-exposed deployments; in-house installs are mostly not affected. Users are advised to upgrade to 5.0.5.
- Affects Apache Kylin 4.0.4 through 5.0.4
- Unauthenticated metadata broadcast on internal networks
- Rated moderate; public exposure is uncommon
- Fixed in Apache Kylin 5.0.5
Vulnerabilities mentionedAll →
- Authentication bypass in Apache Kylin 4.0.4–5.0.4published · Apache Software Foundation Apache Kylin
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108709 | Authentication bypass in Apache Kylin 4.0.4–5.0.4 Apache Kylin 4.0.4 through 5.0.4 has an authentication bypass that can be reached from the in-house network. An unauthenticated attacker on that network can trigger an unauthenticated metadata broadcast. Impact is greatest when Kylin services are exposed directly to the public internet, which the vendor says is uncommon; typical in-house deployments are mostly not affected. The flaw is not listed in CISA KEV and no public proof-of-concept is known. Users should upgrade to 5.0.5. Do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services to the public internet and restrict in-house network access to trusted hosts only. | — | — |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4.0.4 through 5.0.4 Description: Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. This...
This source does not provide full text. Read it at seclists.org.