Insecure Default Initialization of Resource in Apache Kylin - CVE-2026-108833
Published: October 22, 2026
Vulnerability identifier: #VU157264
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108833
CWE-ID: CWE-1188
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially gain unauthorized access to Apache Kylin functionality.
The vulnerability exists due to insecure default initialization in the Apache Kylin startup profile when starting without the security settings profile enabled. A remote attacker can interact with a deployment lacking these security settings to potentially access functionality without the intended security protections.
Affected software
Apache Kylin
How to mitigate CVE-2026-108833
Install security update from vendor's website.
Apache Kylin - update to 5.0.5