VulnerabilityModified
CVE-2025-61735
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.
HIGH 7.3EPSS 0.53%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- CVSS 3.1
- 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS
- 0.53% probability · 44th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- apache/kylin
- Source
- security@apache.org
References
- https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckhIssue Tracking, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/09/30/9
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.