Apache Kylin discloses four flaws in 4.0.0–5.0.4

Four Apache Kylin flaws in 4.0.0–5.0.4 were disclosed on 16 October 2026; three are fixed in 5.0.5, with no reported exploitation.

Apache published four oss-security advisories on 16 October 2026 for Apache Kylin 4.0.0 through 5.0.4. CVE-2026-68571 is a moderate code-injection issue in which a special JDBC URL parameter bypasses whitelist verification; Apache says the greatest impact is on uncommon internet-exposed deployments and does not name a fixed release in that notice. CVE-2026-108780, also tracked as KYLIN-6111, is rated moderate as a JDBC source-configuration validation issue, though Apache describes the impact as minor unless backend services face the public network, and it advises upgrading to 5.0.5. CVE-2026-108823, likewise moderate, can allow unauthenticated replacement of job metadata and exposure of sensitive information when job services are publicly exposed, which Apache calls uncommon, and is fixed in 5.0.5. CVE-2026-108837 is low severity and requires existing project-admin permission to exhaust computed-column resources through a cache API; the fix is also 5.0.5. No notice reports observed exploitation. The JDBC-validation advisory uses both “moderate” for severity and “minor” for impact, and only the latter three advisories state the 5.0.5 upgrade.

• On 2026-10-16, oss-security carried four Apache Kylin advisories: CVE-2026-68571, CVE-2026-108780, CVE-2026-108823, and CVE-2026-108837.
• All four affect Apache Kylin 4.0.0 through 5.0.4.
• CVE-2026-68571 is a moderate code-injection flaw in which a special JDBC URL parameter bypasses whitelist verification; Apache says impact is greatest for uncommon internet-exposed services, and that notice states no fixed version.
• CVE-2026-108780 (KYLIN-6111) is a moderate JDBC source-configuration validation issue whose impact Apache calls minor unless backend services face the public network; users should upgrade to 5.0.5.
• CVE-2026-108823 is a moderate flaw that can allow unauthenticated job-metadata replacement and exposure of sensitive information if job services are publicly exposed, which Apache calls uncommon; it is fixed in 5.0.5.
• CVE-2026-108837 is a low-severity issue requiring project-admin permission to exhaust computed-column resources through a cache API; it is fixed in 5.0.5.
• None of the four notices reports exploitation in the wild.