← All advisories

High severity7.3NVD Advisory· Published Oct 2, 2025· Updated Jun 17, 2026

CVE-2025-61735

CVE-2025-61735

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.kylin:kylinMaven	>= 4.0.0, < 5.0.3	5.0.3
org.apache.kylin:kylin-common-serverMaven	>= 4.0.0, < 5.0.3	5.0.3
org.apache.kylin:kylin-common-serviceMaven	>= 4.0.0, < 5.0.3	5.0.3
org.apache.kylin:kylin-core-commonMaven	>= 4.0.0, < 5.0.3	5.0.3
org.apache.kylin:kylin-core-metadataMaven	>= 4.0.0, < 5.0.3	5.0.3
org.apache.kylin:kylin-ops-serverMaven	>= 4.0.0, < 5.0.3	5.0.3
org.apache.kylin:kylin-serverMaven	>= 4.0.0, < 5.0.3	5.0.3

Affected products

9

Apache/Kylin
cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*
Range: >=4.0.0,<5.0.3
ghsa-coords7 versions
pkg:maven/org.apache.kylin/kylin pkg:maven/org.apache.kylin/kylin-common-server pkg:maven/org.apache.kylin/kylin-common-service pkg:maven/org.apache.kylin/kylin-core-common pkg:maven/org.apache.kylin/kylin-core-metadata pkg:maven/org.apache.kylin/kylin-ops-server pkg:maven/org.apache.kylin/kylin-server
>= 4.0.0, < 5.0.3+ 6 more
- (no CPE)range: >= 4.0.0, < 5.0.3
- (no CPE)range: >= 4.0.0, < 5.0.3
- (no CPE)range: >= 4.0.0, < 5.0.3
- (no CPE)range: >= 4.0.0, < 5.0.3
- (no CPE)range: >= 4.0.0, < 5.0.3
- (no CPE)range: >= 4.0.0, < 5.0.3
- (no CPE)range: >= 4.0.0, < 5.0.3
Apache Software Foundation/Apache Kylinv5
Range: 4.0.0

Patches

Vulnerability mechanics

References

7

github.com/advisories/GHSA-f6m8-qm7j-fh65ghsaADVISORY
lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckhnvdIssue TrackingVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2025-61735ghsaADVISORY
www.openwall.com/lists/oss-security/2025/09/30/9nvdWEB
github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662ghsaWEB
github.com/apache/kylin/pull/2332ghsaWEB
issues.apache.org/jira/browse/KYLIN-6082ghsaWEB

News mentions

0

No linked articles in our index yet.