Live › vulnerability › CVE-2026-108764
Go to dashboardApache Kylin versions 4.0.0 through 5.0.4 contain a server-side request forgery flaw in the job service. An attacker who can reach the job service can make the server send requests to internal or other destinations it chooses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Apache Kylin from 4.0.0 through 5.0.4 are affected, with the greatest exposure where the job service is directly reachable from the public network. The source says in-house deployments are mostly not impacted. Teams whose Kylin job service is kept on internal networks, or who run versions outside the affected range, can skip urgent action.
No product ranges from the sources yet.
4.0.0 through 5.0.4.5.0.5.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108764")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.