VulnerabilityDeferred

CVE-2026-108766

Missing authorization on jdbc source config update in Apache Kylin.

UnscoredEPSS 0.17%

Does this matter?

Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.

Description

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS: Not yet scored
EPSS: 0.17% probability · 6th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Source: security@apache.org

EPSS trend

EPSS moved from 0.2% on 20 October 2026 to 0.2% on 26 October 2026.

References

https://lists.apache.org/thread.html/50447hzwyz8r9xwtfbylsphv4ylq9yhj
http://www.openwall.com/lists/oss-security/2026/10/16/15

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.