Missing Authorization in Apache Kylin - CVE-2026-108766
Published: October 22, 2026
Vulnerability identifier: #VU157258
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108766
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to make unauthorized changes to JDBC source configuration in Apache Kylin.
The vulnerability exists due to missing authorization in the JDBC source configuration update functionality when handling configuration update requests. A remote user can submit configuration changes without the required authorization checks to modify JDBC source settings without permission.
Affected software
Apache Kylin
How to mitigate CVE-2026-108766
Install security update from vendor's website.
Apache Kylin - update to 5.0.5