Read the docs
TI-2023-12577 Aliases CVE-2023-27987GHSA-4x5h-xmv4-99wx

Apache Linkis gateway module token authentication bypass

Priority MEDIUM 49CWE-326Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-326 and CWE-294.

Summary

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1] https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00811 57th percentileScored 2026-11-07
Fix Fixed org.apache.linkis:linkis (Maven): 1.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Linkisup to 1.3.1—No fix listedCNA
—org.apache.linkis:linkis (Maven)before 1.3.21.3.2Patch availableGHSA-4x5h-xmv4-99wx
  • Apache Linkis VendorApache Affected up to 1.3.1 Fixed in — No fix listed CNA
  • org.apache.linkis:linkis (Maven) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-4x5h-xmv4-99wx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*up to 1.3.1VulnerableApache
  • cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:* Versions up to 1.3.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-4x5h-xmv4-99wx org.apache.linkis:linkis (Maven) Fixed in 1.3.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-27987
  2. 2026-10-03 Alias added: GHSA-4x5h-xmv4-99wx

References

Advisory 2

Other 3

  • TI-2023-13644 Apache Linkis DatasourceManager module has a deserialization command execution CVSS 3.1CRITICAL 9.8
  • TI-2023-13643 Apache Linkis JDBC EngineCon has a deserialization command execution CVSS 3.1CRITICAL 9.8
  • TI-2023-12312 Apache Linkis publicsercice module unrestricted upload of file CVSS 3.1CRITICAL 9.8
  • TI-2023-12313 Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue CVSS 3.1CRITICAL 9.8
  • TI-2022-21962 Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability CVSS 3.1HIGH 8.8
  • TI-2022-18910 The Apache Linkis JDBC EngineConn module has a RCE Vulnerability CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences