CVE-2025-59355: Apache Linkis · Sensitive Data in Logs
Affects Apache LinkisSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software FoundationApache Linkis | Affected
| Fixed in– |
Mavenorg.apache.linkis/linkispkg:maven/org.apache.linkis/linkisOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
1. Upgrade Apache Linkis to version 1.8.0 or later, where the vulnerability is fixed by logging desensitized error messages instead of full input strings. 2. Restrict access permissions on log files to ensure only authorized administrators can read them, minimizing the risk of sensitive data exposure. 3. Review and validate configuration files to ensure that sensitive fields such as passwords are correctly Base64 encoded and free of corruption or invalid characters. 4. Implement monitoring to detect unusual error-level logs related to Base64 decoding failures, which may indicate attempted exploitation or misconfiguration. 5. Consider disabling or limiting error-level logging in production environments unless necessary for troubleshooting, to reduce the exposure window. 6. Conduct regular audits of log file contents and access controls as part of security hygiene. 7. Educate administrators on secure configuration management and the risks of logging sensitive information.
Description
CVE-2025-59355 is a medium severity vulnerability in Apache Linkis versions 1.0.0 through 1.7.0 where sensitive information such as Hive Metastore passwords can be exposed in log files if Base64 decoding fails. The vulnerability arises because the decode failure logs the entire input string, potentially containing plaintext secrets, at the error level. This leakage requires that the configuration contains invalid Base64 strings and that log files are accessible to unauthorized users. Apache Linkis 1.8.0 and later mitigate this by logging only desensitized error messages.