CVE-2026-108762

Deferred Deferred - Pending Action

Path-Confinement Bypass in Apache Kylin During Metadata Backup Deletion

Publication date: 2026-10-19

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-30

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2026-108762

EUVD

EUVD-2026-104140

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Kylin	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path-confinement bypass during metadata backup deletion in Apache Kylin. It allows unauthorized access to delete metadata backups outside intended directories, potentially affecting exposed Kylin services.

Detection Guidance

Detection involves checking Apache Kylin versions between 4.0.0 and 5.0.4. Use commands like 'kylin.sh version' or check package managers (e.g., 'rpm -qa | grep kylin' or 'dpkg -l | grep kylin'). Verify if exposed to public networks via network scans or firewall logs.

Impact Analysis

Mostly impacts Kylin services directly exposed to public networks. In-house deployments are generally not affected. Exploitation could lead to unauthorized deletion of metadata backups.

Compliance Impact

The vulnerability's impact on compliance with standards like GDPR or HIPAA is not explicitly addressed in the provided context. The issue involves a path-confinement bypass during metadata backup deletion in Apache Kylin, which primarily affects exposed services. Without direct exposure, the risk to compliance is likely minimal.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later to fix the path-confinement bypass issue.
Check if your Kylin service is exposed to a public network. If so, restrict access or upgrade immediately.
Verify your current Kylin version. If it is between 4.0.0 and 5.0.4, plan an upgrade as soon as possible.

Hi! I’m here to help you understand CVE-2026-108762. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...