CVE-2025-61735: 
Java vulnerability analysis and mitigation

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Apache Kylin, tracked as CVE-2025-61735. The vulnerability affects Apache Kylin versions 4.0.0 through 5.0.2. This security issue was discovered by liuhuajin and publicly disclosed on September 30, 2025 (OSS Security).

The vulnerability is classified as a Server-Side Request Forgery (SSRF) issue with a CVSS 3.1 Base Score of 7.3 (HIGH), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery) (NVD).

The SSRF vulnerability could potentially allow attackers to trick the vulnerable server into making requests to internal services or external systems, which might lead to exposure of sensitive metadata or enable lateral movement within the network (Security Online).

Users are strongly recommended to upgrade to Apache Kylin version 5.0.3, which contains the fix for this vulnerability. The security of the system relies on proper protection of Kylin's system and project admin access (NVD).

The vulnerability was disclosed alongside two other security issues in Apache Kylin (CVE-2025-61733 and CVE-2025-61734), drawing attention to the security posture of this widely used big data analytics platform (Security Online).