CVE-2026-108833: Apache Kylin starts with a default profile lacking security settings

Advisory CVE-2026-108833 states that the default Apache Kylin startup profile does not include security settings. The issue affects versions 4.0.0 through 5.0.4. Deployments that have the security settings profile enabled are not affected. The fix is in version 5.0.5, which the advisory recommends as the upgrade. The project tracks the issue as KYLIN-6113. The advisory was posted on October 15 to the oss-sec list and rated low severity. To verify, consult the original text in the 2026 oss-sec archive using the advisory identifier and compare it with the Apache Kylin project release notes. Teams that run Kylin should check the version in use, confirm whether the security settings profile is active, and plan the upgrade to 5.0.5.