CVE-2024-27181: Apache Linkis vulnerable to privilege escalation

August 2, 2024 (updated June 4, 2025)

In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis’s Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.

References

github.com/advisories/GHSA-v352-rg37-5q5m
github.com/apache/linkis
lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6
nvd.nist.gov/vuln/detail/CVE-2024-27181
www.openwall.com/lists/oss-security/2024/08/02/3

Code Behaviors & Features

Detect and mitigate CVE-2024-27181 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →