CVE-2026-108776 is an SQL Injection vulnerability in Apache Kylin affecting versions 4.0.0 through 5.0.4. The vulnerability allows improper neutralization of special elements in SQL commands. The impact is considered moderate when the Kylin service operates in query-only mode, which is the default and most common configuration. Upgrading to version 5.0.5 addresses this issue.