CVE-2026-108771
Received Received - Intake

Authentication Bypass and Deserialization in Apache Kylin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-108771
EUVD
EUVD-2026-104144

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Kylin 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves two issues in Apache Kylin: missing authentication for in-house broadcast and polymorphic deserialization. It primarily affects Kylin services exposed to public networks, which is uncommon. Most in-house deployments are not impacted.

Detection Guidance

Check Apache Kylin version with command: kylin.sh version. If version is between 4.0.0 and 5.0.4, the system is vulnerable. Inspect network exposure by checking if Kylin services are directly accessible from public networks.

Impact Analysis

The impact is limited to Kylin services directly exposed to the public internet. Most internal deployments are unaffected. Exploitation could lead to unauthorized access or code execution if the service is exposed.

Compliance Impact

The vulnerability involves missing authentication and polymorphic deserialization in Apache Kylin, which could allow unauthorized access to exposed services. This may impact compliance with standards like GDPR or HIPAA if sensitive data is processed or exposed due to the lack of authentication.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later. If immediate upgrade is not possible, restrict network access to Kylin services to prevent public exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart