CVE-2026-108823

Deferred Deferred - Pending Action

Information Exposure in Apache Kylin Job Services

Publication date: 2026-10-19

Last updated on: 2026-11-03

Assigner: Apache Software Foundation

Description

Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2026-108823

EUVD

EUVD-2026-104147

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Kylin	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability involves the exposure of sensitive information to unauthorized actors during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to a public network, which is uncommon.

Detection Guidance

To detect this vulnerability, check if Apache Kylin versions between 4.0.0 and 5.0.4 are running. Inspect job manipulation endpoints for unauthorized access to sensitive information. Verify network exposure of job services to public networks.

Impact Analysis

If job services are exposed to a public network, unauthorized actors could access sensitive information during job manipulation. Otherwise, the impact is minor.

Compliance Impact

The vulnerability involves exposure of sensitive information during job manipulation in Apache Kylin. Compliance impact depends on whether job services are exposed to a public network, which is uncommon. If exposed, it could potentially violate GDPR or HIPAA by leaking sensitive data, but this is not explicitly confirmed in the provided context.

Mitigation Strategies

Upgrade Apache Kylin to version 5.0.5 or later to fix the vulnerability. Ensure job services are not exposed to public networks unless necessary.

Hi! I’m here to help you understand CVE-2026-108823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...