CVE-2026-108823None▾ SunlitExposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4.0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69080High· 7.5Apache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-68572High· 7.5Apache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-69076High· 7.5Apache Kylin: Unauthorized cross-project job discard
CVE-2026-69077High· 7.5Apache Kylin: JobController allows unauthorized cross-project manipulation
CVE-2026-63618High· 7.5Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, w…
CVE-2026-108776NoneApache Kylin: tables/names SparkSQL injection