Advisoriesby IbisApache Software FoundationCVE-2026-108771
Apache Kylin: missing authentication
Apache Software Foundation
Critical9.8CVE-2026-108771 · Published Oct 19, 2026 · updated Oct 30, 2026
No fix yet
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Apache Kylin Product | >= 4.0.0, <= 5.0.4 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- CISA (its enrichment of the CVE record)
- Weakness
- CWE-306