CVE-2026-108743None▾ SunlitImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4.0.4 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108709NoneApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
CVE-2026-69080NoneApache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-69076NoneApache Kylin: Unauthorized cross-project job discard
CVE-2026-68572NoneApache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-68573NoneApache Kylin: Unauthenticated Metastore Cleanup
CVE-2026-69077NoneApache Kylin: JobController allows unauthorized cross-project manipulation