CVE-2025-30067: Apache Kylin Code Injection via JDBC Configuration Alteration
Summary
CVE-2025-30067: Apache Kylin Code Injection via JDBC Configuration Alteration. Affects org.apache.kylin:kylin versions >= 4.0.0, < 5.0.2. Fixed in 5.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kylin is an open-source analytics platform designed for big data that provides a SQL interface and multi-dimensional analysis capabilities. It allows users to build and manage data cubes for fast querying and reporting. However, it has a vulnerability that can be exploited if an attacker gains access to system or project admin permissions, potentially leading to unauthorized code execution.
Vulnerability Detail
The vulnerability arises from improper control over the generation of code, specifically through JDBC connection configuration alterations. If an attacker with admin privileges modifies the JDBC settings, they can execute arbitrary code from a remote location. This poses a significant risk as it can lead to unauthorized access and manipulation of the system, affecting data integrity and security.
How To Fix
Minimum fixed version
5.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While the best solution is to upgrade to the patched version, users can also restrict access to Kylin's system and project admin permissions to mitigate the risk of exploitation until an upgrade can be performed.
Conclusion
In summary, the CVE-2025-30067 vulnerability in Apache Kylin poses a significant risk due to improper control over code generation via JDBC configuration. Users are strongly advised to upgrade to version 5.0.2 or above to mitigate this risk and ensure the security of their data and systems.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
The vulnerability is a code injection issue that allows an attacker to execute arbitrary code by altering JDBC connection configurations.
The vulnerability affects Apache Kylin versions from 4.0.0 through 5.0.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, restrict access to admin permissions to minimize the risk of exploitation.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and compromise of the entire Kylin system.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
