Missing Authentication for Critical Function in Apache Kylin - CVE-2026-108709
Published: October 22, 2026
Vulnerability identifier: #VU157254
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108709
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and potentially gain unauthorized access to metadata broadcast functionality.
The vulnerability exists due to missing authentication checks in Apache Kylin's metadata broadcast functionality when handling network requests. A remote attacker can send requests without authenticating to potentially access functionality intended to be restricted.
The advisory identifies services directly exposed to public networks as primarily impacted and states that most in-house deployments are not impacted.
Affected software
Apache Kylin
How to mitigate CVE-2026-108709
Install security update from vendor's website.
Apache Kylin - update to 5.0.5