---
id: "CVE-2026-108743"
kind: "vulnerability"
aliases: ["CVE-2026-108743"]
title: "Apache Kylin: OS command injection lets attackers run commands on the server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "java", "package", "self-hosted"]
not_affected_if: ["in-house-only-deployment", "not-exposed-to-public-network"]
published_at: "2026-10-16T20:17:19+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T22:33:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108743", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Apache Kylin: OS command injection lets attackers run commands on the server

Apache Kylin versions 4.0.4 through 5.0.4 let an input reach an operating system command without proper neutralization. An attacker who can reach the service may run commands on the host running Kylin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Kylin version (unknown how to read it from the sources); affected range is 4.0.4 through 5.0.4.

## Fix

Upgrade Apache Kylin to version 5.0.5.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108743

## From the sources

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4.0.4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_