Based on the description, Apache Kylin’s job‑driver UI proxy has a server‑side request forgery weakness that allows an attacker to send arbitrary requests to internal resources through the job service. The primary impact is the potential for an attacker to access or abuse internal network endpoints, steal data, or pivot within the infrastructure. The weakness is a classic input validation flaw (CWE‑918).

The vulnerability exists in Apache Kylin versions 4.0.0 through 5.0.4. Systems that expose the job service to the public network are affected; common in‑house deployments are typically not exposed and therefore less likely to be impacted.

The vulnerability is reachable via a job service exposed to the public network. The CVSS score of 6.5 indicates moderate impact, while the EPSS score of less than 1% implies a low probability of exploitation in the wild. The issue is not included in the CISA KEV catalog, so there are no known active exploits. Attackers would need to access an exposed job service, from where the SSRF could reach internal endpoints. Because the vector requires public access, the risk concentrates on configurations that expose the job service; otherwise, the vulnerability is limited.