Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-40564 EUVD-2026-31846GHSA-rj6x-mg28-wf4x

Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

Published May 26, 2026 · Updated Jun 2, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Flink Kubernetes Operator

Description

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.

The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.  This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.

Users are recommended to upgrade to version 1.15.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Flink Kubernetes Operator 1.3.0 – < 1.15.0 1.15.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • oscerd/CVE-2026-40564 ★ 0 · May 29, 2026

    CVE-2026-40564: SSRF via FlinkSessionJob jarURI in apache/flink-kubernetes-operator. Self-contained reproducer that runs on a local kind cluster with one make command.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References