Apache Kylin Flaw: Authentication Bypass and SSRF Vulnerabilities Found in Big Data Platform

On 1 October 2025, the Apache Software Foundation disclosed three vulnerabilities in Apache Kylin, a high-concurrency OLAP engine used for big data analytics, which affect versions 4.0.0 through 5.0.2 and have been patched in 5.0.3. The most critical issue, CVE-2025-61733, is rated High severity and, according to the advisory, is an Authentication Bypass Using an Alternate Path or Channel vulnerability that could allow attackers to bypass authentication and gain access to data or admin functions.

The second flaw, CVE-2025-61734, is Low severity and involves improper restriction of file read, with attackers potentially retrieving sensitive files if access controls are poorly protected. The third flaw, CVE-2025-61735, is also Low severity and concerns Server-Side Request Forgery (SSRF), which could enable the server to be coerced into making internal or external requests. Upgrading to version 5.0.3 is strongly advised to mitigate all three issues.