OS Command Injection in Apache Kylin
Apache Kylin versions 4.0.4 through 5.0.4 contain an OS command injection flaw (CWE-78) tied to Spark job handling. Input is not properly neutralized, so an attacker who can reach a vulnerable Kylin service may cause it to run unintended operating-system commands. Successful exploitation could give command execution on the host with the privileges of the Kylin process. The vendor says the greatest impact is on services exposed directly to the public network, which is uncommon, and that typical in-house deployments are mostly not affected. No public proof of concept is known, the issue is not in CISA's KEV catalog, and exploitation in the wild is not known.
What to do: Upgrade Apache Kylin to version 5.0.5, which fixes this issue. Until then, do not expose Kylin services directly to the public internet and limit access to trusted networks and authenticated users. Check host and application logs for unexpected OS command execution related to Spark jobs.
| Apache Software Foundation Apache Kylin | 4.0.4 through 5.0.4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Apache Kylin 4.0.4 through 5.0.4 has a moderate OS command injection in Spark jobs.
Li Yang reported CVE-2026-108743, an OS command injection flaw in Apache Kylin affecting versions 4.0.4 through 5.0.4. Apache rates the issue moderate. Services exposed directly to the public internet are most at risk, which the project says is uncommon, and typical in-house deployments are mostly not impacted.