CVE-2025-61735: Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability
Summary
CVE-2025-61735: Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability. Affects org.apache.kylin:kylin versions >= 4.0.0, < 5.0.3. Fixed in 5.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Kylin is an open-source analytics platform designed to provide a distributed data warehouse for big data. It enables users to perform OLAP (Online Analytical Processing) on large datasets and offers features such as data modeling, query optimization, and integration with various data sources. The platform is widely used for business intelligence and data analysis, making it crucial for organizations that rely on data-driven decision-making. However, versions 4.0.0 through 5.0.2 of Apache Kylin are vulnerable to a Server-Side Request Forgery (SSRF) attack, which can expose sensitive information and lead to unauthorized access.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the server-side request processing. An attacker can exploit this flaw by crafting a malicious request that tricks the server into making requests to internal services or resources, potentially leading to data leakage or unauthorized actions. The vulnerability is classified under CWE-918, indicating that it allows attackers to send requests to unintended destinations, which can compromise the security of the application and the underlying infrastructure.
How To Fix
Minimum fixed version
5.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the upgrade, it is recommended to restrict access to Kylin's system and project admin interfaces to trusted users only. Implementing network-level controls to limit access to internal services can also mitigate the risk of SSRF attacks.
Conclusion
In summary, the CVE-2025-61735 vulnerability in Apache Kylin poses a significant risk due to its SSRF nature, affecting versions 4.0.0 through 5.0.2. Users are strongly encouraged to upgrade to version 5.0.3 to mitigate this risk. Additionally, implementing access controls can help protect against potential exploitation until the upgrade is completed.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
SSRF is a type of security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data exposure.
Versions 4.0.0 through 5.0.2 of Apache Kylin are affected by the SSRF vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply providing your pom.xml file, you can check for vulnerabilities without needing to install any software.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
If an immediate upgrade is not possible, ensure that access to Kylin's admin interfaces is restricted and implement network controls to limit access to internal services.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
