CVE-2026-108709

Deferred Deferred - Pending Action

Authentication Bypass in Apache Kylin

Publication date: 2026-10-16

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-20

Generated

2026-11-08

AI Q&A

2026-10-17

EPSS Evaluated

2026-11-07

NVD

CVE-2026-108709

EUVD

EUVD-2026-103153

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Kylin	4.0.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is an authentication bypass vulnerability in Apache Kylin versions 4.0.4 through 5.0.4. It allows unauthorized access to Kylin services exposed to public networks, though such exposure is uncommon in typical in-house deployments.

Detection Guidance

To detect this vulnerability, check the version of Apache Kylin running on your system. If it is between 4.0.4 and 5.0.4, it is affected. Use commands like 'kylin.sh version' or check the version in the web UI or logs.

Impact Analysis

If your Kylin service is directly exposed to the public internet, attackers could bypass authentication and gain unauthorized access to sensitive data or system functions. Most in-house deployments are not affected as they are not publicly exposed.

Compliance Impact

This vulnerability is an authentication bypass in Apache Kylin affecting versions 4.0.4 through 5.0.4. It primarily impacts services exposed to public networks, which is uncommon for in-house deployments. The limited exposure reduces direct compliance risks for GDPR or HIPAA, as these standards focus on unauthorized data access or breaches. However, if exploited, it could lead to unauthorized data access, potentially violating compliance requirements depending on data sensitivity and exposure scope.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later immediately. If upgrading is not possible, restrict public network exposure of Kylin services to reduce risk.

Hi! I’m here to help you understand CVE-2026-108709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...