{"affected":[{"defaultStatus":"unaffected","product":"Apache Kylin","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"5.0.4","status":"affected","version":"4.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-108833","cwes":[],"description":"Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","epss":{"date":"2026-11-03","percentile":0.06448,"score":0.0017},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1793747845333,"publishedAt":1792401714065,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/lqb36tsyp3fdsg5x4qvz4fy3hkzcr2wz"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/16/20"},{"source":"security@apache.org","tags":[],"url":"https://lists.apache.org/thread.html/lqb36tsyp3fdsg5x4qvz4fy3hkzcr2wz"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/16/20"}],"remediation":[],"revision":"76e2d181c69bc5b970ab56f9505b3738deadf9d7995709517f188595ba1b3fec","sources":[{"modifiedAt":1793745206038,"name":"CNA: apache","retrievedAt":1793748156846,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108833"},{"modifiedAt":1793747845333,"name":"NVD","retrievedAt":1793751456271,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108833"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748163727,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108833"}],"ssvc":{"assessedAt":1793740404271,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache Kylin: default startup profile miss security settings","updatedAt":1793751456271}