CVE-2026-108766
Received Received - Intake

Authorization Bypass in Apache Kylin JDBC Source Config Update

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-108766
EUVD
EUVD-2026-104143

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Kylin 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves missing authorization checks when updating JDBC source configurations in Apache Kylin. It allows unauthorized users to modify database connection settings, potentially leading to unauthorized data access or manipulation.

Detection Guidance

This vulnerability involves missing authorization on JDBC source config updates in Apache Kylin. To detect it, check if your Apache Kylin version is between 4.0.0 and 5.0.4. Verify if the service is exposed to a public network. No specific commands are provided in the context.

Impact Analysis

If your Apache Kylin service is exposed to the public internet, attackers could exploit this to alter JDBC configurations, potentially accessing or modifying sensitive data. Most in-house deployments are not affected as they are typically not publicly accessible.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements such as GDPR or HIPAA, which mandate strict access controls and data protection. Exploitation may result in data breaches or unauthorized changes to regulated data.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later to fix the missing authorization issue in jdbc source config updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart