{"id":"CVE-2026-108764","kind":"vulnerability","aliases":["CVE-2026-108764"],"related":[],"title":"Apache Kylin: SSRF in job service lets attackers reach internal systems","description":"Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4.0.0 through 5.0.4 contain a server-side request forgery flaw in the job service. An attacker who can reach the job service can make the server send requests to internal or other destinations it chooses.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","java","package","self-hosted"],"not_affected_if":["internal-network-only","version-outside-4.0.0-to-5.0.4"],"how_to_check":"- Check the installed Kylin version and confirm whether it falls in `4.0.0` through `5.0.4`.\n- Check whether the Kylin job service port is reachable from the public network.","fix":"- Upgrade Apache Kylin to `5.0.5`.\n- Until upgraded, restrict network access to the Kylin job service so it is not publicly exposed.","status":"open","published_at":"2026-10-19T10:16:44+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:41+00:00","updated_at":"2026-10-25T05:12:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:12:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`.\n- Until upgraded, restrict network access to the Kylin job service so it is not publicly exposed.","reach":"internet","title":"Apache Kylin: SSRF in job service lets attackers reach internal systems","impact":"medium","summary":"Apache Kylin versions 4.0.0 through 5.0.4 contain a server-side request forgery flaw in the job service. An attacker who can reach the job service can make the server send requests to internal or other destinations it chooses.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","java"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server makes requests to internal systems chosen by the attacker","analyst_note":"Sources do not state whether authentication is required or give a CVSS score; check the Apache Kylin security advisory for the attack prerequisites and impact scope.","how_to_check":"- Check the installed Kylin version and confirm whether it falls in `4.0.0` through `5.0.4`.\n- Check whether the Kylin job service port is reachable from the public network.","needs_analyst":true,"not_affected_if":["internal-network-only","version-outside-4.0.0-to-5.0.4"],"who_is_affected":"Deployments of Apache Kylin from 4.0.0 through 5.0.4 are affected, with the greatest exposure where the job service is directly reachable from the public network. The source says in-house deployments are mostly not impacted. Teams whose Kylin job service is kept on internal networks, or who run versions outside the affected range, can skip urgent action.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3333,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108764':14A,17A '-2026':13A,16A '4.0.0':29B,108C '5.0.4':31B,110C '5.0.5':118C 'affect':104C 'apach':1A,19B,26B,73C,105C 'apache-kylin':18B 'attack':8A,45B 'choos':64B 'common':92C 'contain':32B 'cve':12A,15A 'deploy':97C 'destin':62B 'direct':84C 'expos':85C 'fix':120C 'flaw':39B 'forgeri':38B,69C 'host':25B 'hous':95C 'impact':75C,101C 'in-hous':93C 'intern':10A,59B 'issu':103C,122C 'java':21B 'job':5A,42B,50B,80C 'kylin':2A,20B,27B,74C,79C,96C,106C 'let':7A 'make':53B 'most':99C 'network':88C 'packag':22B 'public':87C 'reach':9A,48B 'recommend':113C 'request':37B,57B,68C 'self':24B 'self-host':23B 'send':56B 'server':35B,55B,66C 'server-sid':34B,65C 'servic':6A,43B,51B,81C 'side':36B,67C 'ssrf':3A,70C 'system':11A 'upgrad':115C 'user':111C 'version':28B,117C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache Kylin from 4.0.0 through 5.0.4 are affected, with the greatest exposure where the job service is directly reachable from the public network. The source says in-house deployments are mostly not impacted. Teams whose Kylin job service is kept on internal networks, or who run versions outside the affected range, can skip urgent action.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108764","severity":null,"published_at":"2026-10-19T10:16:44+00:00","modified_at":"2026-10-19T20:46:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}