VulnerabilityDeferred

CVE-2026-108833

Default startup profile miss security settings in Apache Kylin.

UnscoredEPSS 0.17%

Does this matter?

Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.

Description

Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS: Not yet scored
EPSS: 0.17% probability · 6th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Source: security@apache.org

EPSS trend

EPSS moved from 0.2% on 20 October 2026 to 0.2% on 26 October 2026.

References

https://lists.apache.org/thread.html/lqb36tsyp3fdsg5x4qvz4fy3hkzcr2wz
http://www.openwall.com/lists/oss-security/2026/10/16/20

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.