Threat database

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVE-2026-108709 is a critical authentication bypass vulnerability in Apache Kylin affecting versions from 4.0.4 through 5.0.4. The flaw primarily impacts Kylin services exposed directly to public networks, which is uncommon, while typical in-house deployments are mostly unaffected. The issue allows attackers to bypass authentication, potentially leading to full compromise of confidentiality, integrity, and availability. Users are advised to upgrade to version 5.0.5, which addresses this vulnerability.

Apache Kylin versions 4.0.0 through 5.0.4 contain a vulnerability (CVE-2026-69080) that exposes the SQL Black List to unauthorized actors. This exposure can lead to sensitive information disclosure. The issue is resolved in Apache Kylin version 5.0.5.

CVE-2026-69077 is a vulnerability in Apache Kylin versions 4.0.0 through 5.0.4 that allows unauthorized exposure of sensitive information through cross-project job manipulation. The issue primarily affects Kylin services exposed directly to public networks, which is uncommon, and most in-house deployments are not impacted. The vulnerability has a high severity with a CVSS score of 7.5. Upgrading to Apache Kylin version 5.0.5 addresses this vulnerability.

CVE-2026-69076 is a vulnerability in Apache Kylin that allows unauthorized actors to access sensitive information related to job discard. This affects Apache Kylin versions from 4.0.0 through 5.0.4. The vulnerability primarily impacts Kylin services exposed directly to the public network, which is uncommon, while typical in-house deployments are mostly unaffected. The issue is fixed in version 5.0.5.

Apache Kylin versions 4.0.0 through 5.0.4 contain an improper authentication vulnerability (CWE-287) that allows unauthenticated users to access system cleanup actions. This issue primarily impacts Kylin services exposed directly to public networks, which is uncommon. The vulnerability is fixed in version 5.0.5.

Apache Kylin versions 4 through 5.0.4 contain a vulnerability that allows exposure of sensitive information to unauthorized actors. The issue is addressed in version 5.0.5, which users are recommended to upgrade to in order to remediate the vulnerability.