As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
CVE-2026-108709 is a moderate severity authentication bypass vulnerability in Apache Kylin versions 4.0.4 through 5.0.4 that allows unauthenticated metadata broadcast within in-house networks. The impact is most significant for Kylin services directly exposed to public networks, which the vendor notes is uncommon. Apache recommends upgrading to version 5.0.5 to remediate the issue.
Why it matters: Organizations running Apache Kylin 4.0.4 through 5.0.4 should assess whether their deployments are exposed to public networks and prioritize patching to 5.0.5 if they are.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Apache Kylin versions 4.0.4 through 5.0.4 contain an authentication bypass vulnerability affecting metadata broadcast within in-house networks. The issue primarily impacts Kylin services directly exposed to public networks, which is uncommon, and most in-house deployments are not affected. Users should upgrade to version 5.0.5 to remediate the vulnerability.
Why it matters: Organizations running Apache Kylin 4.0.4 to 5.0.4 on public-facing instances face unauthenticated metadata access; prioritize patching if your Kylin deployment is internet-accessible.
- Source published
- First seen by Cybersecurity Tracker