CVE-2025-61735

Published: Oct 2, 2025Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

Affected (1)

Products: Apache: Kylin

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Kylin	From 4.0.0 to 5.0.3

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh

Source: security@apache.org

Issue TrackingVendor Advisory

http://www.openwall.com/lists/oss-security/2025/09/30/9

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.