CVE-2026-108766None▾ SunlitMissing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue aff…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4.0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108776NoneApache Kylin: tables/names SparkSQL injection
CVE-2026-108780NoneApache Kylin: Potential JDBC source configuration validation issue
CVE-2026-108823NoneApache Kylin: Potential unauthenticated job metadata replacement
CVE-2026-108771NoneApache Kylin: unauthenticated broadcast API and polymorphic deserialization
CVE-2026-108837NoneApache Kylin: Potential computed-column resource exhaustion
CVE-2026-108833NoneApache Kylin: default startup profile miss security settings