Apache Kylin CVE-2026-108771

Exploitation requires the Apache Kylin in-house 'broadcast' API/service to be reachable by the attacker - the vendor states impact is concentrated on Kylin services directly exposed to a public network, which is 'not common,' and that typical in-house (internal-network-only) deployments are mostly unimpacted. The specific prerequisites are therefore: (1) a Kylin instance in the 4.0.0-5.0.4 range, and (2) network reachability to the unauthenticated broadcast/deserialization endpoint from the attacker's position. The primary limiting factor is network exposure: default internal deployments behind perimeter controls are largely out of scope, so this is realistically a risk only for misconfigured or intentionally public-facing clusters. Note the advisory describes the broadcast API as lacking authentication, but no CVSS vector was supplied to independently confirm the privilege requirement.

No CVSS vector, EPSS score, KEV entry, or public POC was provided in the source data, so this assessment rests almost entirely on the vendor (Apache) advisory, which rates the issue 'moderate'. The vulnerability combines two serious primitives - a missing-authentication 'broadcast' API and polymorphic (gadget-chain) deserialization - which in isolation often map to critical, unauthenticated remote code execution. However, the vendor explicitly scopes real-world impact to Kylin services 'directly exposed to public network, which is not common,' and states in-house deployments are mostly unaffected; this environmental caveat is why the vendor severity is only moderate rather than critical, and it is the single most important risk-modifying signal here. There is no CISA KEV listing and no evidence of a public exploit, so exploitation status is 'no public exploit identified at time of analysis.' CONFLICT TO VERIFY: the raw vulnerability class (unauthenticated deserialization) suggests a very high technical-impact, network-reachable flaw, yet the moderate vendor rating hinges on the assumption that Kylin is rarely internet-exposed - organizations that DO expose Kylin broadcast endpoints should treat this as high priority. Absence of EPSS/KEV does not indicate low risk, only that no exploitation telemetry was supplied; treat the moderate label as deployment-conditional, not an inherent ceiling.

An attacker who can reach a Kylin node's internet-exposed broadcast endpoint sends a crafted request to the unauthenticated API carrying a malicious serialized object. Because the endpoint performs polymorphic deserialization without authentication, a suitable gadget chain can be instantiated to achieve remote code execution on the Kylin service host. No public exploit code was identified at time of analysis, and the attack is only viable where the broadcast service is reachable from an untrusted network.