{"id":"CVE-2026-108837","kind":"vulnerability","aliases":["CVE-2026-108837"],"related":[],"title":"Apache Kylin: project admin can exhaust resources via cache API","description":"Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","summary":"Apache Kylin versions 4.0.0 through 5.0.4 let a user with project admin permission call a cache API that triggers computed-column resource exhaustion. An attacker can degrade or crash the service by consuming memory or compute.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kylin","olap","package","self-hosted"],"not_affected_if":["no-project-admin-users","version-outside-4.0.0-to-5.0.4"],"how_to_check":"- Check the installed Apache Kylin version and see whether it falls in `4.0.0` through `5.0.4`.\n- Review which accounts hold project admin permission in Kylin.","fix":"- Upgrade Apache Kylin to `5.0.5`.\n- Restrict project admin permission to trusted users until the upgrade is applied.","status":"open","published_at":"2026-10-19T10:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:36+00:00","updated_at":"2026-10-25T05:12:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:12:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kylin to `5.0.5`.\n- Restrict project admin permission to trusted users until the upgrade is applied.","reach":"network","title":"Apache Kylin: project admin can exhaust resources via cache API","impact":"medium","summary":"Apache Kylin versions 4.0.0 through 5.0.4 let a user with project admin permission call a cache API that triggers computed-column resource exhaustion. An attacker can degrade or crash the service by consuming memory or compute.","category":"package","nicknames":[],"who_cares":["apache-kylin","self-hosted","olap"],"confidence":0.6,"needs_auth":"yes","worst_case":"Service degrades or crashes through resource exhaustion from the cache API.","analyst_note":"","how_to_check":"- Check the installed Apache Kylin version and see whether it falls in `4.0.0` through `5.0.4`.\n- Review which accounts hold project admin permission in Kylin.","needs_analyst":false,"not_affected_if":["version-outside-4.0.0-to-5.0.4","no-project-admin-users"],"who_is_affected":"Teams running Apache Kylin from 4.0.0 through 5.0.4 where users hold project admin permission. The exposure depends on an attacker already having project admin rights, so deployments with tightly limited admin roles are at lower risk. Installations on versions outside the affected range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000596,"input_tokens":3323,"output_tokens":527,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108837':13A,16A '-2026':12A,15A '4.0.0':28B,99C '5.0.4':30B,101C '5.0.5':109C 'admin':4A,36B,79C 'affect':95C 'alloc':62C 'apach':1A,18B,25B,71C,96C 'apache-kylin':17B 'api':10A,41B,83C 'attack':50B,75C 'cach':9A,40B,82C 'call':38B 'caus':87C 'column':46B,90C 'comput':45B,61B,89C 'computed-column':44B,88C 'consum':58B 'crash':54B 'cve':11A,14A 'degrad':52B 'exhaust':6A,48B,92C 'fix':111C 'given':73C 'got':77C 'host':24B 'issu':94C,113C 'kylin':2A,19B,26B,72C,97C 'let':31B 'limit':66C 'mayb':84C 'memori':59B 'olap':20B 'packag':21B 'permiss':37B,80C 'project':3A,35B,78C 'recommend':104C 'resourc':7A,47B,64C,91C 'self':23B 'self-host':22B 'servic':56B 'throttl':68C 'trigger':43B 'upgrad':106C 'use':85C 'user':33B,102C 'version':27B,108C 'via':8A 'vulner':69C 'without':65C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Kylin from 4.0.0 through 5.0.4 where users hold project admin permission. The exposure depends on an attacker already having project admin rights, so deployments with tightly limited admin roles are at lower risk. Installations on versions outside the affected range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108837","severity":null,"published_at":"2026-10-19T10:16:45+00:00","modified_at":"2026-10-19T20:46:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}