---
id: "CVE-2026-108766"
kind: "vulnerability"
aliases: ["CVE-2026-108766"]
title: "Apache Kylin: missing authorization lets users change JDBC source config"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "java", "package", "self-hosted"]
not_affected_if: ["internal-network-only", "not-in-version-range"]
published_at: "2026-10-19T10:16:44+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108766", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Kylin: missing authorization lets users change JDBC source config

Apache Kylin does not check authorization when updating JDBC source configuration, so a user without the right role can change those settings. The description says the impact is mainly for Kylin services directly exposed to the public network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kylin version and see whether it is between `4.0.0` and `5.0.4`
- Check whether Kylin's web or REST service is reachable from the public internet

## Fix

- Upgrade Apache Kylin to `5.0.5`
- Restrict network access to Kylin services that do not need public exposure

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108766

## From the sources

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4.0.0 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_