CVE-2026-108771

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4.0.0 through 5.0.4

Description Apache Kylin contains a missing authentication flaw for in-house broadcast and a polymorphic deserialization issue. Polymorphic deserialization occurs when an application deserializes untrusted data into an object of a type that is not strictly defined, potentially allowing the execution of arbitrary code. This issue primarily impacts services directly exposed to the public network, while internal deployments are generally not affected.

Recommendations Upgrade to version 5.0.5.