SQL injection in Apache Kylin - CVE-2026-108776
Published: October 22, 2026
Vulnerability identifier: #VU157261
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108776
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to manipulate SQL queries, potentially enabling unauthorized access to or modification of data.
The vulnerability exists due to improper neutralization of SQL special elements in Apache Kylin's tables/names functionality when processing input for SparkSQL queries. A remote attacker can supply specially crafted input to alter the intended query structure and potentially access or modify data without authorization.
The advisory characterizes the impact as moderate when the Kylin service operates in query-only mode, which is the default and most common mode.
Affected software
Apache Kylin
How to mitigate CVE-2026-108776
Install security update from vendor's website.
Apache Kylin - update to 5.0.5