CVE-2026-108780 Apache Kylin: Potential JDBC source configuration validation issue
An attacker with high privileges can bypass JDBC source configuration validation in Apache Kylin, potentially exposing backend services if publicly accessible.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108780?
CVE-2026-108780 is a vulnerability in Apache Kylin, published on 19 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Which versions are affected by CVE-2026-108780?
How do I fix CVE-2026-108780?
No fix has been published for CVE-2026-108780 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108780 being exploited?
There is no known exploitation of CVE-2026-108780 in the wild and no public exploit code.
Sources
Also known as GHSA-347f-x236-v6hm.