Missing Authentication and Polymorphic Deserialization Vulnerability in Apache Kylin

CVE-2026-108771

What is CVE-2026-108771?

A significant authentication vulnerability exists within Apache Kylin, allowing unauthorized access to in-house broadcast functionalities and potential exploits through polymorphic deserialization. This vulnerability primarily impacts Kylin services that are exposed to public networks, although in-house deployments are largely unaffected. Users are strongly advised to upgrade to version 5.0.5, which addresses this issue and enhances the overall security posture.

References