Apache Linkis vulnerabilities

18 CVEs affecting Apache Linkis, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-59355, published 2026-01-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-29216, published 2023-04-10. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a…
CVE-2023-29215, published 2023-04-10. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization…
CVE-2023-27602, published 2023-04-10. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version…
CVE-2022-44645, published 2023-01-31. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and…
CVE-2022-39944, published 2022-10-26. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and…
CVE-2023-27603, published 2023-04-10. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We…
CVE-2023-46801, published 2024-07-15. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability…
CVE-2022-44644, published 2023-01-31. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding…
CVE-2023-50740, published 2024-03-06. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0
CVE-2025-29847, published 2026-01-19. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has…

Latest

CVE-2025-59355, published 2026-01-19. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + "decode…
CVE-2024-45627, published 2025-01-14. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to…
CVE-2024-39928, published 2024-09-25. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are…
CVE-2024-27182, published 2024-08-02. Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days. In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are…
CVE-2024-27181, published 2024-08-02. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to…
CVE-2023-49566, published 2024-07-15. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection.…
CVE-2023-41916, published 2024-07-15. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file…