Apache Kylin CVE-2026-108837

Exploitation requires the attacker to already hold Apache Kylin project admin permission; with that privilege, the cache API is abused to drive computed-column processing into allocating resources without limits or throttling, causing resource exhaustion. Limiting factors: this is not reachable by unauthenticated or low-privileged users - it presupposes administrative control over a project, so a compromised or malicious admin account is a prerequisite. Only Apache Kylin versions 4.0.0 through 5.0.4 are affected; upgrading to 5.0.5 removes the condition. Impact is confined to availability (denial of service), with no stated confidentiality or integrity effect.

This is a genuinely low-priority issue, and the available signals are consistent on that point. No CVSS vector, EPSS score, or KEV entry is provided in any source, and there is no public exploit identified at time of analysis. The core limiting factor is the strong precondition stated in the vendor description: the attacker must already hold project admin permission within Apache Kylin before abusing the cache API to trigger computed-column resource exhaustion. A privileged insider or an attacker who has already compromised an admin account is required, which sharply narrows the realistic threat population and keeps impact confined to availability (resource/denial-of-service style exhaustion) rather than confidentiality or integrity. Because no NVD/vendor CVSS vector exists, attack vector and complexity cannot be confirmed from authoritative scoring - they are inferred from the description, which refers to a remotely reachable 'cache API.' Absence of EPSS and KEV data is expected for a freshly disclosed low-severity bug and should not be read as suppressed risk; it simply reflects no observed exploitation. Net assessment: a legitimate but low-urgency defect appropriate for routine patching, not emergency response.

An actor who already possesses Apache Kylin project admin permission (a malicious insider or someone who has compromised such an account) issues repeated or crafted requests to the cache API, driving computed-column processing to allocate resources without limits or throttling until the service degrades or exhausts available resources. No public proof-of-concept exploit has been identified, and the privilege prerequisite means this cannot be executed by an anonymous external attacker.