PT-2025-40312 · Apache · Apache Kylin

Liuhuajin · Published 2025-10-01 · Updated 2025-10-02 · CVE-2025-61735

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4.0.0 through 5.0.2

Description A Server-Side Request Forgery (SSRF) issue exists in Apache Kylin. The impact is limited if Kylin's system and project admin access is well protected.

Recommendations Upgrade to version 5.0.3 to resolve the issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-61735

GHSA-F6M8-QM7J-FH65

Affected Products

Apache Kylin

References · 13

• https://osv.dev/vulnerability/CVE-2025-61735 · Vendor Advisory
• https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f6m8-qm7j-fh65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61735 · Security Note
• https://github.com/apache/kylin/pull/2332 · Note
• https://github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662 · Note
• https://github.com/apache/kylin · Note
• https://twitter.com/CVEnew/status/1973693360075391073 · Twitter Post
• http://openwall.com/lists/oss-security/2025/09/30/9 · Note
• https://twitter.com/oss_security/status/1973527258469122101 · Twitter Post
• https://twitter.com/dailycve/status/1973879045617250755 · Twitter Post
• https://issues.apache.org/jira/browse/KYLIN-6082 · Note
• https://t.me/CVEtracker/33922 · Telegram Post