{
  "from_raw": "Li Yang <liyang@apache.org>",
  "from": "Li Yang <li...@apache.org>",
  "gravatar": "0ade51ef2e48b2a92a3f171fcfeeffda",
  "to": "an...@apache.org,\n us...@kylin.apache.org,\n de...@kylin.apache.org",
  "subject": "CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue",
  "message-id": "<5edd1731-590e-eb5d-77f6-34ad4989be7a@apache.org>",
  "mid": "mvpsqc3q7x7trrnw7lmod15f49o68flt",
  "permalinks": [
    "mvpsqc3q7x7trrnw7lmod15f49o68flt",
    "r2c8ea44aa043eef3416286720655b6bf9767f243f3f42e93c787e322@<dev.kylin.apache.org>"
  ],
  "dbid": "abebc5ba45a71ec61d4e57d164f73be2698f39e8b2220e00af9991e723dce2c7",
  "cc": "",
  "epoch": 1792120221,
  "list": "<dev.kylin.apache.org>",
  "list_raw": "<dev.kylin.apache.org>",
  "date": "2026/10/16 03:10:21",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: moderate \n\nAffected versions:\n\n- Apache Kylin 4.0.0 through 5.0.4\n\nDescription:\n\nPotential JDBC source configuration validation\u00a0vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nThis issue is being tracked as KYLIN-6111 \n\nCredit:\n\nAn academic team studying incomplete security fixes (finder)\n\nReferences:\n\nhttps://kylin.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-108780\nhttps://issues.apache.org/jira/browse/KYLIN-6111\n\n",
  "body_short": "Severity: moderate \n\nAffected versions:\n\n- Apache Kylin 4.0.0 through 5.0.4\n\nDescription:\n\nPotential JDBC source configuration validation\u00a0vulnerability in Apache Kylin. The impact is minor, unless the ",
  "html_source_only": false,
  "attachments": [],
  "forum": "dev@kylin.apache.org",
  "size": 3831,
  "id": "mvpsqc3q7x7trrnw7lmod15f49o68flt"
}