{"id":"CVE-2026-108762","kind":"vulnerability","aliases":["CVE-2026-108762"],"related":[],"title":"Apache Kylin: metadata backup deletion can escape its directory","description":"Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin's metadata backup deletion does not properly confine paths, so a crafted request can delete files outside the intended backup location. The advisory says the impact is mainly for Kylin services directly exposed to the public network.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","big-data","package","self-hosted"],"not_affected_if":["in-house-deployment","not-public-facing"],"how_to_check":"- Check the installed Kylin version, for example by looking at the release in the deployment or package manifest; versions 4.0.0 through 5.0.4 are affected.\n- Check whether the Kylin service is reachable from the public internet (`unknown` for specific commands in the sources).","fix":"- Upgrade Apache Kylin to `5.0.5`, which fixes the issue.","status":"open","published_at":"2026-10-19T10:16:44+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:44+00:00","updated_at":"2026-10-25T05:12:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:12:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`, which fixes the issue.","reach":"unknown","title":"Apache Kylin: metadata backup deletion can escape its directory","impact":"medium","summary":"Apache Kylin's metadata backup deletion does not properly confine paths, so a crafted request can delete files outside the intended backup location. The advisory says the impact is mainly for Kylin services directly exposed to the public network.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","big-data"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Files outside the backup directory may be deleted by the attacker.","analyst_note":"Confirm whether the deletion endpoint requires authentication and what file scope is reachable, using the NVD entry and the Apache Kylin security advisory.","how_to_check":"- Check the installed Kylin version, for example by looking at the release in the deployment or package manifest; versions 4.0.0 through 5.0.4 are affected.\n- Check whether the Kylin service is reachable from the public internet (`unknown` for specific commands in the sources).","needs_analyst":true,"not_affected_if":["in-house-deployment","not-public-facing"],"who_is_affected":"Apache Kylin deployments from 4.0.0 through 5.0.4 are affected. The advisory says the exposure is mainly for Kylin services directly reachable from the public network, and that in-house deployments are mostly not impacted.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":3328,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108762':12A,15A '-2026':11A,14A '4.0.0':108C '5.0.4':110C '5.0.5':118C 'advisori':50B 'affect':104C 'apach':1A,17B,26B,74C,105C 'apache-kylin':16B 'backup':4A,30B,47B,71C 'big':20B 'big-data':19B 'bypass':68C 'common':92C 'confin':35B,67C 'craft':39B 'cve':10A,13A 'data':21B 'delet':5A,31B,42B,72C 'deploy':97C 'direct':59B,84C 'directori':9A 'escap':7A 'expos':60B,85C 'file':43B 'fix':120C 'host':25B 'hous':95C 'impact':53B,76C,101C 'in-hous':93C 'intend':46B 'issu':103C,122C 'kylin':2A,18B,27B,57B,75C,80C,96C,106C 'locat':48B 'main':55B 'metadata':3A,29B,70C 'most':99C 'network':64B,88C 'outsid':44B 'packag':22B 'path':36B,66C 'path-confin':65C 'proper':34B 'public':63B,87C 'recommend':113C 'request':40B 'say':51B 'self':24B 'self-host':23B 'servic':58B,81C 'upgrad':115C 'user':111C 'version':117C","nicknames":[],"mitigations":[],"who_affected":"Apache Kylin deployments from 4.0.0 through 5.0.4 are affected. The advisory says the exposure is mainly for Kylin services directly reachable from the public network, and that in-house deployments are mostly not impacted.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108762","severity":null,"published_at":"2026-10-19T10:16:44+00:00","modified_at":"2026-10-19T20:46:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}