{"id":"CVE-2026-108743","kind":"vulnerability","aliases":["CVE-2026-108743"],"related":[],"title":"Apache Kylin: OS command injection lets attackers run commands on the server","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4.0.4 through 5.0.4 let an input reach an operating system command without proper neutralization. An attacker who can reach the service may run commands on the host running Kylin.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","java","package","self-hosted"],"not_affected_if":["in-house-only-deployment","not-exposed-to-public-network"],"how_to_check":"Check the installed Kylin version (unknown how to read it from the sources); affected range is 4.0.4 through 5.0.4.","fix":"Upgrade Apache Kylin to version 5.0.5.","status":"open","published_at":"2026-10-16T20:17:19+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:33:18+00:00","updated_at":"2026-10-23T22:33:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:33:18Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Kylin to version 5.0.5.","reach":"internet","title":"Apache Kylin: OS command injection lets attackers run commands on the server","impact":"high","summary":"Apache Kylin versions 4.0.4 through 5.0.4 let an input reach an operating system command without proper neutralization. An attacker who can reach the service may run commands on the host running Kylin.","category":"package","who_cares":["apache-kylin","java","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs OS commands on the Kylin server.","analyst_note":"Check the NVD entry and Apache Kylin security advisory for whether authentication is required and which endpoint is affected.","how_to_check":"Check the installed Kylin version (unknown how to read it from the sources); affected range is 4.0.4 through 5.0.4.","needs_analyst":true,"not_affected_if":["in-house-only-deployment","not-exposed-to-public-network"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00049,"input_tokens":2965,"output_tokens":386,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108743':15A,18A '-2026':14A,17A '4.0.4':30B,108C '5.0.4':32B,110C '5.0.5':118C 'affect':104C 'apach':1A,20B,27B,74C,105C 'apache-kylin':19B 'attack':7A,45B 'command':4A,9A,40B,53B,68C,70C 'common':92C 'cve':13A,16A 'deploy':97C 'direct':84C 'element':63C 'expos':85C 'fix':120C 'host':26B,56B 'hous':95C 'impact':76C,101C 'improp':59C 'in-hous':93C 'inject':5A,71C 'input':35B 'issu':103C,122C 'java':22B 'kylin':2A,21B,28B,58B,75C,80C,96C,106C 'let':6A,33B 'may':51B 'most':99C 'network':88C 'neutral':43B,60C 'oper':38B 'os':3A,67C,69C 'packag':23B 'proper':42B 'public':87C 'reach':36B,48B 'recommend':113C 'run':8A,52B,57B 'self':25B 'self-host':24B 'server':12A 'servic':50B,81C 'special':62C 'system':39B 'upgrad':115C 'use':64C 'user':111C 'version':29B,117C 'vulner':72C 'without':41B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108743","severity":null,"published_at":"2026-10-16T20:17:19+00:00","modified_at":"2026-10-20T13:16:39+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}