---
id: "CVE-2026-108780"
kind: "vulnerability"
aliases: ["CVE-2026-108780"]
title: "Apache Kylin: JDBC source configuration validation flaw, minor unless exposed publicly"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "java", "jdbc", "package", "self-hosted"]
not_affected_if: ["internal-only-network", "version-outside-4.0.0-to-5.0.4"]
published_at: "2026-10-19T10:16:44+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108780", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Kylin: JDBC source configuration validation flaw, minor unless exposed publicly

Apache Kylin versions 4.0.0 through 5.0.4 have a flaw in validating JDBC source configuration. The advisory says the impact is minor unless the Kylin backend services are reachable from the public network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kylin version in the deployment, e.g. the `kylin.version` value or the release directory name, and compare it against `4.0.0` through `5.0.4`
- Check whether the Kylin backend services are reachable from the public internet (firewall rules, load balancer, ingress config)

## Fix

- Upgrade Apache Kylin to `5.0.5`, which the advisory says fixes the issue
- Until upgraded, keep Kylin backend services off the public network

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108780

## From the sources

Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network.



This issue affects Apache Kylin: from 4.0.0 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_