Apache Kylin CVE-2026-108766

The attacker must be able to reach the Kylin project JDBC source-configuration update function on a vulnerable instance (versions 4.0.0 through 5.0.4) that lacks the fixed authorization control. The decisive limiting factor stated by the vendor is network exposure: impact is concentrated on Kylin services directly exposed to the public network - which the vendor says is uncommon - while in-house/internal deployments behind network controls are mostly not impacted. Because no CVSS vector or CWE was published and technical details are withheld in the private ASF process, the exact privilege/authentication level required for the config-update endpoint is not confirmed from available data; defenders should treat internet-facing Kylin instances as the realistic exposed population and internal-only instances as substantially lower risk.

Signals are sparse and point to a contained, moderate-priority issue. The vendor (ASF) rates it 'moderate'; no CVSS vector, CWE, EPSS score, KEV listing, or public POC is present in the input, so most quantitative exploitation signals are MISSING rather than confirmed-low. The vulnerability class is a missing authorization check (CWE-862-style) on the project JDBC source-config update path. The vendor itself scopes real-world risk tightly: it 'impacts most the Kylin services that are directly exposed to the public network, which is not common,' and states 'in-house Kylin deployments are mostly not impacted' - this network-exposure caveat is the dominant risk-limiting factor and outweighs the abstract severity of an authz bypass. Because no CVSS vector is supplied, attack vector, complexity, and privilege requirements cannot be confirmed from the data, and authentication requirements are not confirmed from available data. Net: a real but situational issue (internet-facing Kylin instances) rather than a broad or wormable emergency - patch on a normal cycle while prioritizing any externally reachable Kylin nodes.

An attacker able to reach an internet-exposed Apache Kylin instance abuses the missing authorization check on the JDBC source-config update endpoint to alter a project's JDBC data-source configuration without the expected privileges - potentially repointing it at an attacker-controlled database or abusing backend connection settings. No public exploit identified at time of analysis, and the vendor notes public exposure of Kylin is uncommon, so realistic targeting is limited to the minority of externally reachable deployments.