CVE-2025-61735: SSRF in Apache Kylin

The SSRF vulnerability in Apache Kylin allows an attacker to craft malicious requests that the Kylin server will execute. This could lead to the exposure of sensitive internal resources, such as metadata databases or internal APIs. An attacker could potentially scan internal networks, access cloud credentials stored within the Kylin environment, or even trigger actions on other internal systems if they are accessible via HTTP/HTTPS. The blast radius is limited by the network segmentation and access controls in place within the affected environment; however, a successful exploitation could lead to significant data breaches and system compromise.

1. Reserved2025-09-30
2. Published2025-10-02
3. Modified2025-11-05
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-61735 is to upgrade Apache Kylin to version 5.0.3 or later. If an immediate upgrade is not feasible, restrict access to the Kylin system and project admin interfaces to trusted users only. Implement strict network segmentation to limit the potential impact of a successful SSRF attack. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter out malicious requests. Regularly review and update Kylin's configuration to ensure it adheres to security best practices. After upgrade, confirm the fix by attempting a crafted SSRF request and verifying it is blocked.