CVE-2023-46801 is a high severity (CVSS 8.8) deserialization flaw in Apache Linkis data source management that can lead to remote code execution when a MySQL data source is added. It needs an authorized account and affects Java below 1.8.0_241. Upgrade Linkis to 1.6.0 or upgrade Java.
What's affected
The NVD description says Linkis 1.5.0 and earlier is affected when run on Java below 1.8.0_241. The Apache announcement we read lists "Apache Linkis DataSource 1.4.0 before 1.6.0", which is not the same range. So the sources disagree, and treating everything up to 1.5.0 as in scope is safest. Apache rates the issue moderate, while NVD scores it 8.8 High.
The fix is Linkis 1.6.0. Apache also offers a mitigation: run on Java 1.8.0_241 or later. The attack needs an authorized Linkis account. The weakness is CWE-502.
The NVD record scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-502 (deserialization of untrusted data). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the Linkis version from the release package or the management console, and check the Java runtime on each Linkis host:
java -version
If the Java version is below 1.8.0_241 and Linkis is 1.5.0 or earlier, you are in the described scope. Also review which users hold accounts and whether data source management is reachable from outside your network.
What to do now
- Upgrade Apache Linkis to 1.6.0 or later.
- Upgrade Java to 1.8.0_241 or later on all Linkis hosts as an additional mitigation.
- Review accounts that can add data sources, and remove those that do not need it.
- Restrict network access to the Linkis gateway.
- Check for unexpected files or processes on Linkis servers.
Why it matters
Deserialization flaws arise when a server rebuilds objects from data an attacker influences. In this case the data source feature can be made to reach a remote object service. Later Java releases restrict that kind of remote class loading, which is why the Java version appears in the advice.
Because it needs a valid account, the score is held below critical. Shared data platforms often hand out accounts widely, so the practical exposure is wider than the privilege requirement suggests.
Quick check
Is Java 8u241 enough?
Apache lists upgrading Java as a mitigation, but also recommends upgrading Linkis to 1.6.0.
Do the sources agree on versions?
No. NVD says 1.5.0 and earlier, the Apache announcement says 1.4.0 before 1.6.0.
Sources
Last reviewed: 19 October 2026.
