Missing Authorization in Apache Kylin JDBC Source Configuration

CVE-2026-108766

What is CVE-2026-108766?

A vulnerability has been identified in Apache Kylin where a lack of proper authorization checks on JDBC source configuration updates could potentially allow unauthorized users to make critical changes to configurations. This issue primarily affects Kylin services that are openly accessible over the public network, making them more vulnerable to exploitation. In-house deployments, however, are less likely to be affected and are generally considered more secure. Users are strongly advised to upgrade to version 5.0.5, which addresses this security loophole and enhances overall system integrity.

References