CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection
Apache Kylin 4.0.0–5.0.4 allows SparkSQL injection via table names, fixed in 5.0.5.
CVE-2026-108776 is an SQL injection in Apache Kylin table-name handling for SparkSQL, affecting versions 4.0.0 through 5.0.4. Apache rates the impact moderate when Kylin runs in query-only mode, which is the default and most common deployment. The fix is version 5.0.5. The advisory does not report active exploitation.
- SparkSQL injection via table names in Apache Kylin 4.0.0–5.0.4.
- Rated moderate in the default, common query-only mode.
- Fixed by upgrading to Kylin 5.0.5; no exploitation reported.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108776 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Li Yang on Oct 15 Severity: moderate Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes...
This source does not provide full text. Read it at seclists.org.