# org.apache.kylin:kylin (Maven) vulnerabilities

13 known vulnerabilities (1 critical, 5 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.kylin/kylin

## Advisories (13)

### [CVE-2025-61735](https://cve.now/CVE-2025-61735): Apache Kylin: Server-Side Request Forgery

- Severity: High 7.3
- Published: Oct 2, 2025
- Affected: from 4.0.0, fixed in 5.0.3.

### [CVE-2025-61733](https://cve.now/CVE-2025-61733): Apache Kylin: Authentication bypass

- Severity: High 7.5
- Published: Oct 2, 2025
- Affected: from 4.0.0, fixed in 5.0.3.

### [CVE-2025-61734](https://cve.now/CVE-2025-61734): Apache Kylin: improper restriction of file read

- Severity: High 7.5
- Published: Oct 2, 2025
- Affected: from 4.0.0, fixed in 5.0.3.

### [CVE-2025-30067](https://cve.now/CVE-2025-30067): Apache Kylin: The remote code execution via jdbc url

- Severity: High 7.2
- Published: Mar 27, 2025
- Affected: from 4.0.0, fixed in 5.0.2.

### [CVE-2024-23590](https://cve.now/CVE-2024-23590): Apache Kylin: Session fixation in web interface

- Severity: Critical 9.1
- Published: Nov 4, 2024
- Affected: from 2.0.0, fixed in 5.0.0.

### [CVE-2022-43396](https://cve.now/CVE-2022-43396): Apache Kylin: Command injection by Useless configuration

- Severity: High 8.8
- Published: Dec 30, 2022
- Affected: from 2.0.0, fixed in 4.0.3.

### [CVE-2021-45458](https://cve.now/CVE-2021-45458): Hardcoded credentials

- Severity: Unrated
- Published: Jan 6, 2022
- Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.

### [CVE-2021-45457](https://cve.now/CVE-2021-45457): Overly broad CORS configuration

- Severity: Unrated
- Published: Jan 6, 2022
- Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.

### [CVE-2021-45456](https://cve.now/CVE-2021-45456): Command injection

- Severity: Unrated
- Published: Jan 6, 2022
- Affected: fixed in 4.0.1.

### [CVE-2021-36774](https://cve.now/CVE-2021-36774): Mysql JDBC Connector Deserialize RCE

- Severity: Unrated
- Published: Jan 6, 2022
- Affected: fixed in 3.1.3.

### [CVE-2021-31522](https://cve.now/CVE-2021-31522): Apache Kylin unsafe class loading

- Severity: Unrated
- Published: Jan 6, 2022
- Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.

### [CVE-2021-27738](https://cve.now/CVE-2021-27738): Improper Access Control to Streaming Coordinator & SSRF

- Severity: Unrated
- Published: Jan 6, 2022
- Affected: fixed in 3.1.3.

### [CVE-2020-13937](https://cve.now/CVE-2020-13937): Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6…

- Severity: Unrated
- Published: Oct 19, 2020
- Affected: fixed in 3.1.1; from 4.0.0-alpha, fixed in 4.0.0-beta.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.kylin:kylin
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.