{"id":"CVE-2026-108833","kind":"vulnerability","aliases":["CVE-2026-108833"],"related":[],"title":"Apache Kylin: default startup profile omits security settings, weakening deployments","description":"Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin's default startup profile leaves out security settings, so a default deployment runs without them. The sources do not say what an attacker can do beyond that, and the description does not name the specific missing settings.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","java","package","self-hosted"],"not_affected_if":["security-profile-enabled"],"how_to_check":"- Look at the startup profile Kylin uses by default and confirm whether the security settings profile is enabled, as the description says deployments with it on are not affected.\n- Check the Kylin version with the install's version file or `unknown` if the sources do not give a command.","fix":"- Upgrade Apache Kylin to `5.0.5`, which the sources say fixes the issue.\n- Enable the security settings profile if upgrading is not possible, per the advisory's note that deployments with it on are not affected.","status":"open","published_at":"2026-10-19T10:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:37+00:00","updated_at":"2026-10-25T05:12:37+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T05:12:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`, which the sources say fixes the issue.\n- Enable the security settings profile if upgrading is not possible, per the advisory's note that deployments with it on are not affected.","reach":"unknown","title":"Apache Kylin: default startup profile omits security settings, weakening deployments","impact":"medium","summary":"Apache Kylin's default startup profile leaves out security settings, so a default deployment runs without them. The sources do not say what an attacker can do beyond that, and the description does not name the specific missing settings.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","java"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not say what an attacker gains","analyst_note":"Find the NVD or Apache advisory text naming the specific missing security settings and the attack they enable, at https://nvd.nist.gov/vuln/detail/CVE-2026-108833.","how_to_check":"- Look at the startup profile Kylin uses by default and confirm whether the security settings profile is enabled, as the description says deployments with it on are not affected.\n- Check the Kylin version with the install's version file or `unknown` if the sources do not give a command.","needs_analyst":true,"not_affected_if":["security-profile-enabled"],"who_is_affected":"Apache Kylin deployments from 4.0.0 through 5.0.4 that run on the default startup profile without the security settings profile enabled are affected. Deployments that already have the security settings profile turned on are not affected, and the sources do not say more about exposure.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3289,"output_tokens":594,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108833':13A,16A '-2026':12A,15A '4.0.0':90C '5.0.4':92C '5.0.5':100C 'affect':86C 'apach':1A,18B,25B,71C,87C 'apache-kylin':17B 'attack':49B 'beyond':52B 'cve':11A,14A 'default':3A,28B,37B,64C 'deploy':10A,38B,74C 'descript':56B 'fix':102C 'host':24B 'impact':83C 'issu':85C,104C 'java':20B 'kylin':2A,19B,26B,72C,88C 'leav':31B 'miss':62B,67C 'name':59B 'omit':6A 'packag':21B 'profil':5A,30B,66C,78C 'recommend':95C 'run':39B 'say':46B 'secur':7A,33B,68C,76C 'self':23B 'self-host':22B 'set':8A,34B,63B,69C,77C 'sourc':43B 'specif':61B 'startup':4A,29B,65C 'turn':79C 'upgrad':97C 'user':93C 'version':99C 'weaken':9A 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Apache Kylin deployments from 4.0.0 through 5.0.4 that run on the default startup profile without the security settings profile enabled are affected. Deployments that already have the security settings profile turned on are not affected, and the sources do not say more about exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108833","severity":null,"published_at":"2026-10-19T10:16:45+00:00","modified_at":"2026-10-19T20:46:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}