CVE-2023-49566 is a high severity JNDI injection flaw, scored 8.8, in Apache Linkis 1.5.0 and earlier. Malicious DB2 parameters in the DataSource Manager module trigger it, and the attacker needs an authorized account. The record recommends upgrading to Linkis 1.6.0.
What's affected
The record says Apache Linkis versions up to and including 1.5.0 are affected, and recommends upgrading to 1.6.0. Because of missing filtering of parameters, an attacker who configures malicious db2 parameters in the DataSource Manager module causes JNDI injection. The record adds that the DB2 URL parameters should be blacklisted, and that the attacker needs an authorized Linkis account.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The Apache mailing list thread that the record links did not return readable content when I fetched it, so the version facts here come from the NVD record text.
How to check if you're exposed
Check which Linkis version you run. For a Maven project that depends on Linkis modules, list them.
mvn dependency:tree | grep -i linkis
For a deployed cluster, read the version from the installation or the admin pages. Anything up to 1.5.0 is in scope.
Then check who holds Linkis accounts, since the attack needs an authorized one.
What to do now
- Find every Linkis deployment and its version.
- Upgrade to 1.6.0, as the record recommends.
- Audit which users can create or edit data sources in the DataSource Manager module and reduce that group.
- Restrict outbound connections from the Linkis hosts so they cannot reach arbitrary LDAP or RMI servers.
- Review existing DB2 data source definitions for unexpected parameters.
- Keep the advisory in your tracker, and check the Apache Linkis security page for any follow up fixes after 1.6.0.
Why it matters
The weakness is listed as deserialization of untrusted data, CWE-502. JNDI is a Java lookup mechanism. If an application lets a user steer a lookup to a server the user controls, the application may load content from that server.
The record frames it as a parameter filtering problem. Connection URLs for databases often accept extra parameters, and drivers act on them. Treat any user supplied connection string as untrusted input. KEV status is false for this CVE.
If you run Linkis as the computing middleware between applications and data engines, review how data source definitions are created and who may create them. A narrow group, with changes logged, reduces the chance that one stolen account turns into a lookup against an attacker's server. An egress allow list on the hosts is a second layer that does not depend on any one patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the vendor recommended fix?
Upgrade Apache Linkis to 1.6.0, per the record. The record also suggests blacklisting DB2 URL parameters.
Sources
Apache Linkis announcement thread (content not readable when fetched)
Last reviewed: 19 October 2026.
