{"id":"CVE-2026-108823","kind":"vulnerability","aliases":["CVE-2026-108823"],"related":[],"title":"Apache Kylin: job manipulation leaks sensitive information to unauthorized users","description":"Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4.0.0 through 5.0.4 expose sensitive information to an unauthorized actor during job manipulation. The impact is described as minor unless job services are reachable from the public network.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","data-platform","package","self-hosted"],"not_affected_if":["private-network-only","version-outside-range"],"how_to_check":"- Check the installed Kylin version and see whether it falls in `4.0.0` through `5.0.4`\n- Check whether the job service is reachable from outside your private network","fix":"- Upgrade Apache Kylin to `5.0.5`","status":"open","published_at":"2026-10-19T10:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:36+00:00","updated_at":"2026-10-25T05:12:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:12:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`","reach":"unknown","title":"Apache Kylin: job manipulation leaks sensitive information to unauthorized users","impact":"low","summary":"Apache Kylin versions 4.0.0 through 5.0.4 expose sensitive information to an unauthorized actor during job manipulation. The impact is described as minor unless job services are reachable from the public network.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","data-platform"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unauthorized users read sensitive job information","analyst_note":"","how_to_check":"- Check the installed Kylin version and see whether it falls in `4.0.0` through `5.0.4`\n- Check whether the job service is reachable from outside your private network","needs_analyst":false,"not_affected_if":["private-network-only","version-outside-range"],"who_is_affected":"Teams running Apache Kylin 4.0.0 through 5.0.4. The description says the impact is minor unless job services are exposed to the public network, which it calls uncommon. Teams that keep Kylin job services on a private network face a lower risk, but the sources do not say whether that reduces exposure to zero.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000571,"input_tokens":3331,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108823':13A,16A '-2026':12A,15A '4.0.0':30B,93C '5.0.4':32B,95C '5.0.5':103C 'actor':39B,65C 'affect':89C 'apach':1A,18B,27B,70C,90C 'apache-kylin':17B 'cve':11A,14A 'data':21B 'data-platform':20B 'describ':46B 'expos':33B,80C 'exposur':58C 'fix':105C 'host':26B 'impact':44B,73C 'inform':7A,35B,61C 'issu':88C,107C 'job':3A,41B,50B,67C,77C 'kylin':2A,19B,28B,71C,91C 'leak':5A 'manipul':4A,42B,68C 'minor':48B,75C 'network':57B,83C 'packag':23B 'platform':22B 'public':56B,82C 'reachabl':53B 'recommend':98C 'self':25B 'self-host':24B 'sensit':6A,34B,60C 'servic':51B,78C 'unauthor':9A,38B,64C 'uncommon':86C 'unless':49B,76C 'upgrad':100C 'user':10A,96C 'version':29B,102C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Kylin 4.0.0 through 5.0.4. The description says the impact is minor unless job services are exposed to the public network, which it calls uncommon. Teams that keep Kylin job services on a private network face a lower risk, but the sources do not say whether that reduces exposure to zero.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108823","severity":null,"published_at":"2026-10-19T10:16:45+00:00","modified_at":"2026-10-19T20:46:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}