CVE-2026-108766

CVE-2026-108766

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.

This issue affects Apache Kylin: from 4.0.0 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00197 · 9.0th percentile
Published
2026-10-19T14:16Z
References (2)
https://lists.apache.org/thread.html/50447hzwyz8r9xwtfbylsphv4ylq9yhj · [email protected]http://www.openwall.com/lists/oss-security/2026/10/16/15 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 09:20Z
    Apache Kylin: missing JDBC-config authorization
    cvelistv5
  • 19 OCT 09:20Z
    Apache Kylin: missing JDBC-config authorization
    cvelistv5