Server-Side Request Forgery (SSRF) in Apache Kylin - CVE-2026-108764
Published: October 22, 2026
Vulnerability identifier: #VU157257
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108764
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause the server to send requests to unintended destinations, potentially accessing otherwise unreachable resources.
The vulnerability exists due to insufficient validation of request destinations in the Apache Kylin job-driver UI proxy when handling proxy requests. A remote attacker can submit crafted requests to induce server-side requests to unintended destinations, potentially accessing resources reachable from the server.
The advisory identifies job services directly exposed to the public network as the primary exposure scenario and states that in-house deployments are mostly not impacted.
Affected software
Apache Kylin
How to mitigate CVE-2026-108764
Install security update from vendor's website.
Apache Kylin - update to 5.0.5