CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement
Published Oct 19, 2026
·Updated
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected Software
1 affected component
Apache Kylin>=4.0.0<=5.0.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kylinto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Oct 19, 2026
CVE Published
via MITRE·09:21 AM
Data Sourced
via MITRE·09:21 AM
DescriptionWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are most exposed?
Deployments where Apache Kylin job services are exposed to the public network are the most exposed. The reported impact is minor when those services are not publicly reachable.
2
What versions require remediation?
Apache Kylin versions from 4.0.0 through 5.0.4 are affected. Upgrade to version 5.0.5, which fixes the issue.