{"id":"CVE-2026-108776","kind":"vulnerability","aliases":["CVE-2026-108776"],"related":[],"title":"Apache Kylin: SQL injection flaw, moderate impact in query-only mode","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4.0.0 through 5.0.4 contain an SQL injection flaw in which special SQL elements are not neutralized. The sources say the impact is moderate when the Kylin service runs in query-only mode, which is the default and most common mode.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","data-platform","package","self-hosted"],"not_affected_if":["version-outside-4.0.0-to-5.0.4"],"how_to_check":"- Check the installed Kylin version and see whether it falls between `4.0.0` and `5.0.4`\n- Confirm the deployment mode of the Kylin service; the sources say query-only mode is the default and most common\n- unknown for the exact vulnerable code path and any request shape that triggers it","fix":"- Upgrade Apache Kylin to `5.0.5`, which the sources say fixes the issue","status":"open","published_at":"2026-10-19T10:16:44+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:40+00:00","updated_at":"2026-10-25T05:12:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:12:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`, which the sources say fixes the issue","reach":"unknown","title":"Apache Kylin: SQL injection flaw, moderate impact in query-only mode","impact":"medium","summary":"Apache Kylin versions 4.0.0 through 5.0.4 contain an SQL injection flaw in which special SQL elements are not neutralized. The sources say the impact is moderate when the Kylin service runs in query-only mode, which is the default and most common mode.","category":"package","nicknames":[],"who_cares":["apache-kylin","data-platform","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs injected SQL against the Kylin backend data","analyst_note":"Check the NVD entry and Apache Kylin security advisory for auth requirements, the attack vector, and the exact impact of query-only mode.","how_to_check":"- Check the installed Kylin version and see whether it falls between `4.0.0` and `5.0.4`\n- Confirm the deployment mode of the Kylin service; the sources say query-only mode is the default and most common\n- unknown for the exact vulnerable code path and any request shape that triggers it","needs_analyst":true,"not_affected_if":["version-outside-4.0.0-to-5.0.4"],"who_is_affected":"Teams running Apache Kylin from `4.0.0` through `5.0.4`. The sources say impact is moderate when the service runs in query-only mode, the default and most common mode. The sources do not say which other modes or configurations change exposure, so unknown whether non-default setups are affected differently.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3349,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108776':15A,18A '-2026':14A,17A '4.0.0':32B,115C '5.0.4':34B,117C '5.0.5':125C 'affect':111C 'apach':1A,20B,29B,87C,112C 'apache-kylin':19B 'command':82C 'common':71B,107C 'contain':35B 'cve':13A,16A 'data':23B 'data-platform':22B 'default':68B,104C 'element':44B,77C 'fix':127C 'flaw':5A,39B 'host':28B 'impact':7A,52B,90C 'improp':73C 'inject':4A,38B,84C 'issu':110C,129C 'kylin':2A,21B,30B,57B,88C,94C,113C 'mode':12A,64B,72B,100C,108C 'moder':6A,54B,92C 'neutral':47B,74C 'packag':25B 'platform':24B 'queri':10A,62B,98C 'query-on':9A,61B 'recommend':120C 'run':59B 'say':50B 'self':27B 'self-host':26B 'servic':58B,95C 'sourc':49B 'special':42B,76C 'sql':3A,37B,43B,81C,83C 'upgrad':122C 'use':78C 'user':118C 'version':31B,124C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Kylin from `4.0.0` through `5.0.4`. The sources say impact is moderate when the service runs in query-only mode, the default and most common mode. The sources do not say which other modes or configurations change exposure, so unknown whether non-default setups are affected differently.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108776","severity":null,"published_at":"2026-10-19T10:16:44+00:00","modified_at":"2026-10-19T20:46:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}