CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection
Apache Kylin 4.0.0–5.0.4 allows SparkSQL injection via table names, fixed in 5.0.5.
CVE-2026-108776 is an SQL injection in Apache Kylin table-name handling for SparkSQL, affecting versions 4.0.0 through 5.0.4. Apache rates the impact moderate when Kylin runs in query-only mode, which is the default and most common deployment. The fix is version 5.0.5. The advisory does not report active exploitation.
36