Live › vulnerability › CVE-2026-108776
Go to dashboardApache Kylin versions 4.0.0 through 5.0.4 contain an SQL injection flaw in which special SQL elements are not neutralized. The sources say the impact is moderate when the Kylin service runs in query-only mode, which is the default and most common mode.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Kylin from through . The sources say impact is moderate when the service runs in query-only mode, the default and most common mode. The sources do not say which other modes or configurations change exposure, so unknown whether non-default setups are affected differently.
4.0.05.0.4No product ranges from the sources yet.
4.0.0 and 5.0.45.0.5, which the sources say fixes the issueEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108776")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.