CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement

Q: Which deployments are most exposed?

Deployments where Apache Kylin job services are exposed to the public network are the most exposed. The reported impact is minor when those services are not publicly reachable.

Q: What versions require remediation?

Apache Kylin versions from 4.0.0 through 5.0.4 are affected. Upgrade to version 5.0.5, which fixes the issue.

Published Oct 19, 2026

Updated

Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.

This issue affects Apache Kylin: from 4.0.0 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=4.0.0<=5.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Event History

Oct 19, 2026

CVE Published

via MITRE·09:21 AM

Data Sourced

via MITRE·09:21 AM

DescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are most exposed?

Deployments where Apache Kylin job services are exposed to the public network are the most exposed. The reported impact is minor when those services are not publicly reachable.

What versions require remediation?

Apache Kylin versions from 4.0.0 through 5.0.4 are affected. Upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed?

What versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What versions require remediation?