CVE-2026-108743: Apache Kylin: spark job OS command injection

Apache Kylin versions 4.0.4 through 5.0.4 contain an OS command injection flaw (CWE-78) tied to Spark job handling. Input is not properly neutralized, so an attacker who can reach a vulnerable Kylin service may cause it to run unintended operating-system commands. Successful exploitation could give command execution on the host with the privileges of the Kylin process. The vendor says the greatest impact is on services exposed directly to the public network, which is uncommon, and that typical in-house deployments are mostly not affected. No public proof of concept is known, the issue is not in CISA's KEV catalog, and exploitation in the wild is not known.

Do: Upgrade Apache Kylin to version 5.0.5, which fixes this issue. Until then, do not expose Kylin services directly to the public internet and limit access to trusted networks and authenticated users. Check host and application logs for unexpected OS command execution related to Spark jobs.