AI and data stack advisories

Severe, 6 weeks1490Projects326

1490 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-108833

Apache Kylin: insecure default

Apache Software Foundation

CVE-2026-108833 · Published Oct 19, 2026 · updated Nov 4, 2026

High7.5
No fix yet
Apache Software Foundation advisory

Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact.

This issue affects Apache Kylin: from 4.0.0 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected versions

PackageAffectedFixed in
Apache Kylin
Product
>= 4.0.0, <= 5.0.4No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-1188

More Apache Software Foundation advisories

All Apache Software Foundation
High 8.8Oct 19Apache Camel: unsafe deserializationCVE-2026-88900fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: information disclosureCVE-2026-85317fixed in 4.18.5 +1Medium 6.5Oct 19Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2...CVE-2026-85296fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: improper input validationCVE-2026-85312fixed in 4.18.5 +1Medium 4.3Oct 19Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache...CVE-2026-85313fixed in 4.18.5 +1Medium 6.5Oct 19Apache Camel: improper input validationCVE-2026-85314fixed in 4.18.5 +1