Live › vulnerability › CVE-2026-108709
Go to dashboardApache Kylin versions 4.0.4 through 5.0.4 contain an authentication bypass that lets a remote attacker get past login on the Kylin service. The sources state the flaw is most dangerous when Kylin is directly exposed to the public internet, and that in-house deployments are mostly not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the deployed Kylin version against 4.0.4 through 5.0.4
Check whether the Kylin service port is reachable from the public internet
Upgrade Apache Kylin to version 5.0.5
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108709")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.