AI and data stack advisories

Severe, 6 weeks1490Projects326

1490 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-108823

Apache Kylin: information disclosure

Apache Software Foundation

CVE-2026-108823 · Published Oct 19, 2026 · updated Nov 3, 2026

High7.5
No fix yet
Apache Software Foundation advisory

Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.

This issue affects Apache Kylin: from 4.0.0 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected versions

PackageAffectedFixed in
Apache Kylin
Product
>= 4.0.0, <= 5.0.4No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-200

More Apache Software Foundation advisories

All Apache Software Foundation
High 8.8Oct 19Apache Camel: unsafe deserializationCVE-2026-88900fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: information disclosureCVE-2026-85317fixed in 4.18.5 +1Medium 6.5Oct 19Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2...CVE-2026-85296fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: improper input validationCVE-2026-85312fixed in 4.18.5 +1Medium 4.3Oct 19Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache...CVE-2026-85313fixed in 4.18.5 +1Medium 6.5Oct 19Apache Camel: improper input validationCVE-2026-85314fixed in 4.18.5 +1