Apache Kylin: Server-Side Request Forgery
Priority LOW 34CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01042 64th percentileScored 2026-11-07
Fix Fixed org.apache.kylin:kylin (Maven): 5.0.3org.apache.kylin:kylin-common-server (Maven): 5.0.3+5 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Kylin | 4.0.0 – 5.0.2 | — | No fix listed | CNA |
| — | org.apache.kylin:kylin (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-f6m8-qm7j-fh65 |
| — | org.apache.kylin:kylin-common-server (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-f6m8-qm7j-fh65 |
| — | org.apache.kylin:kylin-common-service (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-f6m8-qm7j-fh65 |
| — | org.apache.kylin:kylin-core-common (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-f6m8-qm7j-fh65 |
| — | org.apache.kylin:kylin-core-metadata (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-f6m8-qm7j-fh65 |
| — | org.apache.kylin:kylin-ops-server (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-f6m8-qm7j-fh65 |
| — | org.apache.kylin:kylin-server (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-f6m8-qm7j-fh65 |
- Apache Kylin VendorApache Affected 4.0.0 – 5.0.2 Fixed in — No fix listed CNA
- org.apache.kylin:kylin (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-f6m8-qm7j-fh65
- org.apache.kylin:kylin-common-server (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-f6m8-qm7j-fh65
- org.apache.kylin:kylin-common-service (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-f6m8-qm7j-fh65
- org.apache.kylin:kylin-core-common (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-f6m8-qm7j-fh65
- org.apache.kylin:kylin-core-metadata (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-f6m8-qm7j-fh65
- org.apache.kylin:kylin-ops-server (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-f6m8-qm7j-fh65
- org.apache.kylin:kylin-server (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-f6m8-qm7j-fh65
Remediation
- Fix · GHSA-f6m8-qm7j-fh65 org.apache.kylin:kylin (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-f6m8-qm7j-fh65 org.apache.kylin:kylin-common-server (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-f6m8-qm7j-fh65 org.apache.kylin:kylin-common-service (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-f6m8-qm7j-fh65 org.apache.kylin:kylin-core-common (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-f6m8-qm7j-fh65 org.apache.kylin:kylin-core-metadata (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-f6m8-qm7j-fh65 org.apache.kylin:kylin-ops-server (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-f6m8-qm7j-fh65 org.apache.kylin:kylin-server (Maven) Fixed in 5.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61735
- 2026-10-03 Alias added: GHSA-f6m8-qm7j-fh65
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Advisory 2
More Apache Kylin vulnerabilities
- TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
- TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
- TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
- TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
- TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
- TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-61735 · CVE Program
- CVE-2025-61735 · NVD
- FIRST EPSS
- GHSA-f6m8-qm7j-fh65 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences