Information disclosure in Apache Kylin - CVE-2026-108823
Published: October 22, 2026
Vulnerability identifier: #VU157263
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108823
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and potentially replace job metadata without authorization.
The vulnerability exists due to insufficient protection of sensitive information in Apache Kylin's job manipulation functionality when handling job metadata operations. A remote attacker can manipulate job metadata without authentication to access sensitive information and potentially replace that metadata.
The impact is described as minor unless job services are exposed to a public network.
Affected software
Apache Kylin
How to mitigate CVE-2026-108823
Install security update from vendor's website.
Apache Kylin - update to 5.0.5