---
id: "CVE-2026-108823"
kind: "vulnerability"
aliases: ["CVE-2026-108823"]
title: "Apache Kylin: job manipulation leaks sensitive information to unauthorized users"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "data-platform", "package", "self-hosted"]
not_affected_if: ["private-network-only", "version-outside-range"]
published_at: "2026-10-19T10:16:45+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108823", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Kylin: job manipulation leaks sensitive information to unauthorized users

Apache Kylin versions 4.0.0 through 5.0.4 expose sensitive information to an unauthorized actor during job manipulation. The impact is described as minor unless job services are reachable from the public network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kylin version and see whether it falls in `4.0.0` through `5.0.4`
- Check whether the job service is reachable from outside your private network

## Fix

- Upgrade Apache Kylin to `5.0.5`

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108823

## From the sources

Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.



This issue affects Apache Kylin: from 4.0.0 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_