https://seclists.org/oss-sec/2026/q4/196: CVE-2026-108837: Apache Kylin: Potential computed-column source exhaustion

Q: Who can exploit this issue?

An attacker needs project administrator permission in Apache Kylin. The issue is therefore relevant where project-admin access is granted to untrusted or insufficiently controlled users.

Q: Which deployments are affected?

Apache Kylin versions 4.0.0 through 5.0.4 are affected. Version 5.0.5 fixes the issue.

Q: What can happen if the issue is exploited?

A project administrator can use a cache API to trigger resource exhaustion involving computed columns. The advisory characterizes the severity as low.

Published Oct 16, 2026

Updated

Affected Software

1 affected component

Apache Kylin>=4.0.0<=5.0.4

Frequently Asked Questions

Who can exploit this issue?

An attacker needs project administrator permission in Apache Kylin. The issue is therefore relevant where project-admin access is granted to untrusted or insufficiently controlled users.

Which deployments are affected?

Apache Kylin versions 4.0.0 through 5.0.4 are affected. Version 5.0.5 fixes the issue.

What can happen if the issue is exploited?

A project administrator can use a cache API to trigger resource exhaustion involving computed columns. The advisory characterizes the severity as low.