{
  "from_raw": "Li Yang <liyang@apache.org>",
  "from": "Li Yang <li...@apache.org>",
  "gravatar": "0ade51ef2e48b2a92a3f171fcfeeffda",
  "to": "an...@apache.org,\n us...@kylin.apache.org,\n de...@kylin.apache.org",
  "subject": "CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization",
  "message-id": "<58411043-df3f-b995-8c46-a7f1e9fd7013@apache.org>",
  "mid": "d77s7dh3bxf02l4rjbgb6807g605zskx",
  "permalinks": [
    "d77s7dh3bxf02l4rjbgb6807g605zskx",
    "rc8d1f04a0048caa472a3f1c64479503a72322bb81113299e7895b60d@<dev.kylin.apache.org>"
  ],
  "dbid": "60f0560e1eb478313950b74a8798653aad6075b0c1ef640798b9ec2b23da86f9",
  "cc": "",
  "epoch": 1792119910,
  "list": "<dev.kylin.apache.org>",
  "list_raw": "<dev.kylin.apache.org>",
  "date": "2026/10/16 03:05:10",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: moderate \n\nAffected versions:\n\n- Apache Kylin 4.0.0 through 5.0.4\n\nDescription:\n\nMissing authentication for in-house broadcast and\u00a0polymorphic deserialization\u00a0vulnerability in Apache Kylin.\u00a0Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nCredit:\n\nMopMonk-AI (finder)\nWanxin Yin (finder)\nDilrevx (finder)\n\nReferences:\n\nhttps://kylin.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-108771\n\n",
  "body_short": "Severity: moderate \n\nAffected versions:\n\n- Apache Kylin 4.0.0 through 5.0.4\n\nDescription:\n\nMissing authentication for in-house broadcast and\u00a0polymorphic deserialization\u00a0vulnerability in Apache Kylin.\u00a0I",
  "html_source_only": false,
  "attachments": [],
  "forum": "dev@kylin.apache.org",
  "size": 3772,
  "id": "d77s7dh3bxf02l4rjbgb6807g605zskx"
}