CVE-2026-108709

validated

GHSA-9qj3-8pcf-3r59 ↗EUVD-2026-103153 ↗

check availableproven exploitable

cve.orgpublic pockev

Apache Software Foundation Apache Kylin >= 4.0.4, <= 5.0.4

CWE-287 Improper Authentication

ETK-2026-2016, permanent identifier

cvss9.8nvdCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

+2.1dTTV

1h 10mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0dcheck + exploit+2.1d

+1d

description

Apache Kylin versions 4.0.4 through 5.0.4 are affected by an authentication bypass. An attacker may gain access without normal authentication when an affected Kylin service is exposed to a public network; internally deployed instances are described as less likely to be affected.

mitigation

Upgrade Apache Kylin to version 5.0.5. Until upgraded, restrict Kylin service access to trusted internal networks and prevent direct public exposure.

check

available

exploit

yes

automation

deterministic

auth required

EPSS

0.25%15th percentile

agent run time

1h 10m

cve.org record, t = 0

2026-10-16 19:38Z

Δ to public poc

–

Δ to kev

–

outcome

Differential: the exploit fired on the vulnerable build and stayed silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-16 19:38Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-108709

this entry in the feed

GET /api/v1/feed/CVE-2026-108709

{
  "etk_id": "ETK-2026-2016",
  "cve_id": "CVE-2026-108709",
  "display_id": "CVE-2026-108709",
  "ghsa_id": "GHSA-9qj3-8pcf-3r59",
  "euvd_id": "EUVD-2026-103153",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Apache Kylin",
  "summary": "Apache Kylin versions 4.0.4 through 5.0.4 are affected by an authentication bypass. An attacker may gain access without normal authentication when an affected Kylin service is exposed to a public network; internally deployed instances are described as less likely to be affected.",
  "mitigation": "Upgrade Apache Kylin to version 5.0.5. Until upgraded, restrict Kylin service access to trusted internal networks and prevent direct public exposure.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Kylin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.4, <= 5.0.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Kylin",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0025,
  "epss_percentile": 0.1549,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 70.19155848333334,
  "t0_at": "2026-10-16T19:38:21.601000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T22:05:24.067574+00:00",
      "days": 2.1021118816435185,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T19:38:21.601000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-10-18T22:05:24.067574+00:00",
      "days": 2.1021118816435185,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T19:38:21.601000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T19:38:21.601000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T19:38:21.601000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108709"
    }
  }
}

published 2026-10-18 20:55Z
last change 2026-10-21 17:13Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.