Live › vulnerability › CVE-2026-108771
Go to dashboardApache Kylin 4.0.0 through 5.0.4 has a missing authentication check on an internal broadcast endpoint combined with polymorphic deserialization. An attacker who can reach a Kylin service directly from the public internet may be able to trigger unsafe object deserialization.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments in the affected range that expose Kylin services directly to the public network are at real risk, according to the advisory. The advisory says in-house deployments are mostly not impacted. Teams running Kylin behind a private network or firewall are likely lower risk, but the sources do not give exact exposure conditions.
No product ranges from the sources yet.
4.0.0 through 5.0.45.0.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108771")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.