---
id: "CVE-2026-108776"
kind: "vulnerability"
aliases: ["CVE-2026-108776"]
title: "Apache Kylin: SQL injection flaw, moderate impact in query-only mode"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kylin", "data-platform", "package", "self-hosted"]
not_affected_if: ["version-outside-4.0.0-to-5.0.4"]
published_at: "2026-10-19T10:16:44+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108776", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Kylin: SQL injection flaw, moderate impact in query-only mode

Apache Kylin versions 4.0.0 through 5.0.4 contain an SQL injection flaw in which special SQL elements are not neutralized. The sources say the impact is moderate when the Kylin service runs in query-only mode, which is the default and most common mode.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kylin version and see whether it falls between `4.0.0` and `5.0.4`
- Confirm the deployment mode of the Kylin service; the sources say query-only mode is the default and most common
- unknown for the exact vulnerable code path and any request shape that triggers it

## Fix

- Upgrade Apache Kylin to `5.0.5`, which the sources say fixes the issue

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108776

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode.



This issue affects Apache Kylin: from 4.0.0 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_