CVE-2026-108762

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

• CWE-22

• https://lists.apache.org/thread.html/6n1o1t14ssc5x4dg18hlv30crwbhwdpd
• https://www.openwall.com/lists/oss-security/2026/10/16/13

Published

Oct 19, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108756Abilityai Trinity through 0.9.5 contains a missing authoriza…5.4
• CVE-2026-108757Nexting pinclaw OpenClaw channel plugin through 0.3.0 contai…6.5
• CVE-2026-108758Easy!Appointments through 1.6.0 contains an authorization by…8.2
• CVE-2026-108759mistral.rs 0.9.0 through 0.9.4 contains a link following vul…6.8
• CVE-2026-10876A weakness has been identified in SourceCodester Ship Ferry …6.3
• CVE-2026-108760LlamaFarm through 0.0.34 contains an insecure default config…7.6
• CVE-2026-108763The Wallet System for WooCommerce WordPress plugin before 2…4.3
• CVE-2026-108764Server-Side request forgery (SSRF) vulnerability in Apache K…6.5
• CVE-2026-108766Missing authorization on jdbc source config update in Apache…6.5
• CVE-2026-108768A vulnerability was identified in zhayujie CowAgent up to 2.…4.3
• CVE-2026-108769A security flaw has been discovered in zhayujie CowAgent up …4.3
• CVE-2026-10877A security vulnerability has been detected in SourceCodester…7.3