Apache Kylin: Authentication bypass within in-house network
Summary
Apache Kylin, an OLAP analytics engine, in versions 4.0.4 through 5.0.4 contains an authentication bypass (CWE-287) that allows access without valid authentication. According to the vendor, an attacker needs network access to the Kylin services, and the impact mainly concerns instances directly exposed to the public network, while in-house deployments are mostly not affected. Successful exploitation can lead to a total impact on confidentiality, integrity and availability. The CVSS 9.8 rating comes from the submitted data and is not yet confirmed by NVD.
Affected
- Apache Kylin 4.0.4 through 5.0.4 (according to the CNA record)
- Unknown: whether 4.0.0 to 4.0.3 are affected; sister CVEs of the same batch list 4.0.0 as lower bound
- Kylin Java library artifacts may also be affected, e.g. org.apache.kylin:kylin-engine-build-sdk 5.0.0 to 5.0.4 (third-party database listing)
Fixed in
- Apache Kylin 5.0.5 (recommended by the vendor)
- Unknown: whether a fixed 4.x release exists
Workaround
- No workaround issued by the vendor.
- Generic defence in depth: restrict inbound access to Kylin ports to known, trusted IP addresses.
Exploitation
- No public proof of concept reported by aggregator sites; not listed in CISA KEV in the sources checked.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS about 0.004 (low).
- Re-check CISA KEV before relying on this.
Our recommendation
- Check whether Apache Kylin is installed, including as a library in other applications.
- Prioritise instances reachable from the internet, a partner network or a DMZ and restrict their exposure now.
- Upgrade to 5.0.5; ask the vendor whether 4.x users need a separate fix.
- Restrict access to Kylin ports to trusted addresses and monitor logs for unexpected access.
- Patch together with CVE-2026-68573 and CVE-2026-108771 from the same batch.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- oss-security post (Openwall) www.openwall.com
- Apache mailing list thread lists.apache.org
- Strix CVE-2026-108709 www.strix.ai
- Vulners CIRCL CVE-2026-108709 vulners.com
- VulDB CVE-2026-108709 vuldb.com
- TheHackerWire CVE-2026-108709 www.thehackerwire.com
- Vulners PT-2026-116146 vulners.com
- Apache Kylin release notes kylin.apache.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:37.
Original description (NVD)
Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.