Apache Kylin CVE-2026-108709

Exploitation requires network reachability to the Apache Kylin broadcast/metadata-processing endpoint. Per the vendor, impact is largely confined to the in-house (cluster/internal) network, so the attacker generally needs an existing foothold on that internal network segment; the high-impact scenario requires the non-default and 'not common' condition of a Kylin service being directly exposed to the public network. Affected deployments are limited to Apache Kylin 4.0.4 through 5.0.4; instances upgraded to 5.0.5 or configured so that Kylin is not internet-exposed are the primary limiting factors reducing realistic risk.

This is a moderate-severity authentication bypass (Apache JIRA KYLIN-6107, 'Potential unauthenticated broadcast processing issue') with no public exploit identified at time of analysis and no CISA KEV listing. Critically, no CVSS vector, EPSS score, or SSVC decision data was provided - CVSS is explicitly 'N/A' in the input - so the quantitative exploitation-probability signals that normally drive prioritization are entirely absent and cannot be compared or contrasted. The only authoritative severity signal is the ASF's own 'moderate' rating. The vendor description substantially tempers the raw risk: real impact is confined to Kylin services directly exposed to the public network, which the advisory states 'is not common,' and 'In-house kylin deployments are mostly not impacted.' The vulnerability class (an unauthenticated node-to-node metadata broadcast within the in-house/cluster network) suggests exposure to attackers who already hold a foothold on the internal network rather than widespread internet-facing exploitation. Net assessment: this is a genuine authentication-bypass bug worth patching, but it is a low-to-moderate real-world priority for typical internal deployments and only elevates to a meaningful concern where a Kylin instance is misconfigured to face the public internet. Key missing data (CVSS vector, EPSS, POC status, SSVC) should be treated as unknown, not favorable.

An attacker positioned on the same in-house network as an Apache Kylin cluster (4.0.4 through 5.0.4) sends a crafted metadata broadcast message that the service processes without authenticating the sender, bypassing intended access controls. In the uncommon case where the Kylin service is directly exposed to the public network, a remote attacker could reach this broadcast handler directly; no public exploit code has been identified at time of analysis.