CVE-2025-30067: Code Injection in Apache Kylin

Successful exploitation of CVE-2025-30067 hinges on an attacker gaining administrative access to the Apache Kylin system or project. Once this access is achieved, they can modify the JDBC connection configuration, injecting malicious code that will be executed remotely. The potential impact is significant, ranging from data exfiltration and system compromise to complete control of the Kylin instance. This could lead to the compromise of sensitive data processed by Kylin, disruption of business intelligence operations, and potentially, lateral movement within the network if Kylin is integrated with other systems. While the CVSS score is LOW, the requirement for admin privileges and the potential for severe consequences necessitate prompt remediation.

1. Reserved2025-03-15
2. Published2025-03-27
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-30067 is to upgrade Apache Kylin to version 5.0.2 or later, which includes the necessary fix. If an immediate upgrade is not feasible, restrict access to Kylin's system and project admin roles to only trusted personnel. Implement robust authentication and authorization controls to prevent unauthorized access. Consider implementing a Web Application Firewall (WAF) with rules to detect and block suspicious JDBC connection attempts. Regularly review and audit JDBC connection configurations for any signs of tampering. After upgrading, verify the fix by attempting to establish a JDBC connection with a test user account and confirming that no arbitrary code execution is possible.