AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-108764

Apache Kylin: server-side request forgery

Apache Software Foundation

CVE-2026-108764 · Published Oct 19, 2026 · updated Oct 30, 2026

Medium6.5
No fix yet
Apache Software Foundation advisory

Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.

This issue affects Apache Kylin: from 4.0.0 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected versions

PackageAffectedFixed in
Apache Kylin
Product
>= 4.0.0, <= 5.0.4No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-918

More Apache Software Foundation advisories

All Apache Software Foundation
Medium 5.4Oct 19Incorrect implementation of authentication algorithm vulnerability in Apache...CVE-2026-86589no fix yetMedium 5.3Oct 19Apache Answer: missing authorizationCVE-2026-68482no fix yetHigh 7.3Oct 19Apache Kylin: path traversalCVE-2026-108762no fix yetMedium 6.5Oct 19Apache Kylin: missing authorizationCVE-2026-108766no fix yetCritical 9.8Oct 19Apache Kylin: missing authenticationCVE-2026-108771no fix yetMedium 5.3Oct 19Apache Kylin: SQL injectionCVE-2026-108776no fix yet