Server-Side Request Forgery Vulnerability in Apache Kylin by Apache
CVE-2026-108764

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Kylin
Vendor
CVE Published:
19 October 2026

What is CVE-2026-108764?

A server-side request forgery (SSRF) vulnerability exists in Apache Kylin, primarily affecting versions 4.0.0 through 5.0.4. The issue impacts Kylin job services that are exposed to public networks, which is an uncommon configuration. In-house deployments are typically shielded from this risk. Users are advised to upgrade to version 5.0.5 to mitigate this exposure and secure their applications.

Affected Version(s)

Apache Kylin 4.0.0 <= 5.0.4

References

https://lists.apache.org/thread.html/m35g1w482qbznocjkp2v...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k Security
.