{"id":"CVE-2026-108771","kind":"vulnerability","aliases":["CVE-2026-108771"],"related":[],"title":"Apache Kylin: unauthenticated broadcast flaw enables unsafe deserialization on exposed servers","description":"Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin 4.0.0 through 5.0.4 has a missing authentication check on an internal broadcast endpoint combined with polymorphic deserialization. An attacker who can reach a Kylin service directly from the public internet may be able to trigger unsafe object deserialization.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","java","package","self-hosted"],"not_affected_if":["private-network-only","versions-outside-4.0.0-5.0.4"],"how_to_check":"- Check the installed Kylin version and whether it falls in `4.0.0` through `5.0.4`\n- Confirm whether Kylin services are reachable from the public network, for example on the Kylin web or service port","fix":"- Upgrade Apache Kylin to `5.0.5`","status":"open","published_at":"2026-10-19T10:16:44+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:40+00:00","updated_at":"2026-10-25T05:12:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:12:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`","reach":"internet","title":"Apache Kylin: unauthenticated broadcast flaw enables unsafe deserialization on exposed servers","impact":"high","summary":"Apache Kylin 4.0.0 through 5.0.4 has a missing authentication check on an internal broadcast endpoint combined with polymorphic deserialization. An attacker who can reach a Kylin service directly from the public internet may be able to trigger unsafe object deserialization.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","java"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; deserialization may allow code execution on the server","analyst_note":"Check the NVD entry and Apache Kylin security announcement for the exact exposed endpoint, whether authentication is needed, and the deserialization impact.","how_to_check":"- Check the installed Kylin version and whether it falls in `4.0.0` through `5.0.4`\n- Confirm whether Kylin services are reachable from the public network, for example on the Kylin web or service port","needs_analyst":true,"not_affected_if":["private-network-only","versions-outside-4.0.0-5.0.4"],"who_is_affected":"Only deployments in the affected range that expose Kylin services directly to the public network are at real risk, according to the advisory. The advisory says in-house deployments are mostly not impacted. Teams running Kylin behind a private network or firewall are likely lower risk, but the sources do not give exact exposure conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3350,"output_tokens":583,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108771':14A,17A '-2026':13A,16A '4.0.0':28B,112C '5.0.4':30B,114C '5.0.5':122C 'abl':60B 'affect':108C 'apach':1A,19B,26B,78C,109C 'apache-kylin':18B 'attack':46B 'authent':34B,67C 'broadcast':4A,39B,72C 'check':35B 'combin':41B 'common':96C 'cve':12A,15A 'deploy':101C 'deseri':8A,44B,65B,75C 'direct':53B,88C 'enabl':6A 'endpoint':40B 'expos':10A,89C 'fix':124C 'flaw':5A 'host':25B 'hous':71C,99C 'impact':80C,105C 'in-hous':69C,97C 'intern':38B 'internet':57B 'issu':107C,126C 'java':21B 'kylin':2A,20B,27B,51B,79C,84C,100C,110C 'may':58B 'miss':33B,66C 'most':103C 'network':92C 'object':64B 'packag':22B 'polymorph':43B,74C 'public':56B,91C 'reach':49B 'recommend':117C 'self':24B 'self-host':23B 'server':11A 'servic':52B,85C 'trigger':62B 'unauthent':3A 'unsaf':7A,63B 'upgrad':119C 'user':115C 'version':121C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Only deployments in the affected range that expose Kylin services directly to the public network are at real risk, according to the advisory. The advisory says in-house deployments are mostly not impacted. Teams running Kylin behind a private network or firewall are likely lower risk, but the sources do not give exact exposure conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108771","severity":null,"published_at":"2026-10-19T10:16:44+00:00","modified_at":"2026-10-19T20:46:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}