CVE-2026-108780

Deferred Deferred - Pending Action

JDBC Configuration Validation Flaw in Apache Kylin

Publication date: 2026-10-19

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-30

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2026-108780

EUVD

EUVD-2026-104146

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Kylin	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This is a potential JDBC source configuration validation vulnerability in Apache Kylin. It allows minor impact unless the backend services are exposed to a public network.

Detection Guidance

To detect this vulnerability, check the Apache Kylin version running on your system. If it is between 4.0.0 and 5.0.4, the system is potentially vulnerable. Run: kylin.sh version or check the version in the web UI.

Impact Analysis

The impact is minor unless the Kylin backend services are accessible from the public internet. In such cases, it could lead to unauthorized access or data exposure.

Compliance Impact

This vulnerability has minimal impact unless the Kylin backend services are exposed to a public network. It does not directly affect compliance with standards like GDPR or HIPAA as it does not involve data exposure or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later immediately. If upgrading is not possible, restrict network access to the Kylin backend services to prevent public exposure.

Hi! I’m here to help you understand CVE-2026-108780. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...