OS Command Injection Vulnerability in Apache Kylin Affecting Multiple Versions
CVE-2026-108743

8.8HIGH

Key Information:

Vendor

Apache
Status
Apache Kylin
Vendor
CVE Published:
16 October 2026

What is CVE-2026-108743?

A security flaw in Apache Kylin introduces an OS Command Injection vulnerability that could allow attackers to execute arbitrary commands. This flaw primarily impacts Kylin services exposed to the public network, although many in-house deployments are generally not at risk. Users running versions 4.0.4 through 5.0.4 are advised to upgrade to version 5.0.5 to remediate this vulnerability effectively.

Affected Version(s)

Apache Kylin 4.0.4 <= 5.0.4

References

https://lists.apache.org/thread.html/6x2v755lrxf72xcrzjq4...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k Security
.