CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF
Apache Kylin 4.0.0 through 5.0.4 has a moderate job-driver SSRF flaw, fixed in 5.0.5.
Apache disclosed CVE-2026-108764, a moderate server-side request forgery flaw in the Apache Kylin job-driver UI proxy. It affects Kylin 4.0.0 through 5.0.4, with the greatest impact on job services exposed to the public internet, which Apache says is uncommon. Users are advised to upgrade to 5.0.5. No exploitation is reported.
- Moderate SSRF affects the Kylin job-driver UI proxy.
- Versions 4.0.0 through 5.0.4 are affected; 5.0.5 fixes it.
- Public exposure of the job service is described as uncommon.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108764 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue....
This source does not provide full text. Read it at seclists.org.