CVE-2026-108771

{
  "etk_id": "ETK-2026-2050",
  "cve_id": "CVE-2026-108771",
  "display_id": "CVE-2026-108771",
  "ghsa_id": "GHSA-8p62-58r2-prmw",
  "euvd_id": "EUVD-2026-104144",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated deserialization in Apache Kylin",
  "summary": "Apache Kylin versions 4.0.0 through 5.0.4 contain an authentication gap in broadcast functionality involving polymorphic deserialization. An unauthenticated attacker may interact with the affected service when it is directly exposed to a public network.",
  "mitigation": "Upgrade Apache Kylin to version 5.0.5. Until upgraded, restrict public network access to Kylin services.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Kylin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, <= 5.0.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Kylin",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": 0.0024,
  "epss_percentile": 0.1406,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 142.44660616666667,
  "t0_at": "2026-10-19T09:20:59.076000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T09:20:59.076000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T09:20:59.076000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108771"
    }
  }
}