Live › vulnerability › CVE-2026-108766
Go to dashboardApache Kylin does not check authorization when updating JDBC source configuration, so a user without the right role can change those settings. The description says the impact is mainly for Kylin services directly exposed to the public network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Apache Kylin from through are affected, with the highest impact on Kylin services directly exposed to the public network. The description says in-house deployments are mostly not impacted, so teams running Kylin only on internal networks are lower priority but should still upgrade.
4.0.05.0.4No product ranges from the sources yet.
4.0.0 and 5.0.45.0.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108766")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.