Advisoriesby IbiskylinGHSA-f6m8-qm7j-fh65
Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability
Fix: upgrade to 5.0.3 or later
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kylin:kylin Maven | >= 4.0.0, < 5.0.3 | 5.0.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-918
- Also known as
- CVE-2025-61735
- nvd.nist.gov/vuln/detail/CVE-2025-61735
- github.com/apache/kylin/pull/2332
- github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662
- github.com/apache/kylin
- issues.apache.org/jira/browse/KYLIN-6082
- lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh
- www.openwall.com/lists/oss-security/2025/09/30/9
More kylin advisories
All kylin
Apache Kylin Authentication Bypass VulnerabilityCVE-2025-61733fixed in 5.0.3Apache Kylin Files or Directories Accessible to External PartiesCVE-2025-61734fixed in 5.0.3Apache Kylin Code Injection via JDBC Configuration AlterationCVE-2025-30067fixed in 5.0.2Apache Kylin Session Fixation vulnerabilityCVE-2024-23590fixed in 5.0.0Apache Kylin vulnerable to Command injection by Useless configurationCVE-2022-43396fixed in 4.0.3Authentication bypass in Apache KylinCVE-2020-13937fixed in 3.1.1 +1