Live › vulnerability › CVE-2026-108762
Go to dashboardApache Kylin's metadata backup deletion does not properly confine paths, so a crafted request can delete files outside the intended backup location. The advisory says the impact is mainly for Kylin services directly exposed to the public network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Apache Kylin deployments from 4.0.0 through 5.0.4 are affected. The advisory says the exposure is mainly for Kylin services directly reachable from the public network, and that in-house deployments are mostly not impacted.
No product ranges from the sources yet.
unknown for specific commands in the sources).5.0.5, which fixes the issue.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108762")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.