CVE-2026-108823None▾ SunlitExposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4.0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69080NoneApache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-68572NoneApache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-69076NoneApache Kylin: Unauthorized cross-project job discard
CVE-2026-69077NoneApache Kylin: JobController allows unauthorized cross-project manipulation
CVE-2026-63618High· 7.5Apache Kylin: Low-Privilege Config Exposure
CVE-2026-108776NoneApache Kylin: tables/names SparkSQL injection