CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
Apache Kylin’s broadcast API lacks authentication and allows polymorphic deserialization through 5.0.4.
CVE-2026-108771 covers missing authentication on Apache Kylin’s in-house broadcast API together with polymorphic deserialization, affecting 4.0.0 through 5.0.4. Apache rates it moderate and says impact is greatest when services are exposed to the public network, which is uncommon. Typical internal deployments are mostly not affected. Users should upgrade to 5.0.5; exploitation is not reported.
- Broadcast API lacks authentication and uses polymorphic deserialization.
- Highest risk when Kylin is exposed directly to the internet.
- Internal deployments are mostly unaffected; fix is 5.0.5.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108771 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade...
This source does not provide full text. Read it at seclists.org.