CVE-2026-108743: Apache Kylin: spark job OS command injection

Q: Which deployments are most exposed to this issue?

Kylin services directly exposed to a public network are most affected. The available information indicates that in-house Kylin deployments are mostly not impacted.

Q: Which Apache Kylin versions need remediation?

Apache Kylin versions from 4.0.4 through 5.0.4 are affected. Upgrade to version 5.0.5 to fix the issue.

Published Oct 16, 2026

Updated

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.

This issue affects Apache Kylin: from 4.0.4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected Software

1 affected component

Apache Kylin>=4.0.4<=5.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Kylin to a version that resolves this vulnerability.
Fixed in 5.0.5

Event History

Oct 16, 2026

CVE Published

via MITRE·07:44 PM

Data Sourced

via MITRE·07:44 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Kylin services directly exposed to a public network are most affected. The available information indicates that in-house Kylin deployments are mostly not impacted.

Which Apache Kylin versions need remediation?