PT-2026-43265 · Apache · Apache Flink Kubernetes Operator

Andrea Cosentino · Published 2026-05-26 · Updated 2026-06-01 · CVE-2026-40564

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Flink Kubernetes Operator versions 1.3.0 through 1.14.x

Description A Server-Side Request Forgery (SSRF) and local file access issue exists where the jarURI in FlinkSessionJob is not validated. This allows a user with CR create permissions to read files from the operator pod's filesystem and retrieve content from any backing store reachable via Flink's pluggable filesystem layer. For http/https addresses, there is no URI scheme allowlist, host check, IP-range restriction, or protection against internal or link-local addresses.

Recommendations Upgrade to version 1.15.0.

Exploit

Fix

Files Accessible to External Parties

SSRF

Weakness Enumeration

CWE-552

CWE-918

Related Identifiers

BDU:2026-07535

CVE-2026-40564

Affected Products

Apache Flink Kubernetes Operator

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40564.json · Exploit
• 🔥 https://github.com/oscerd/CVE-2026-40564 · Exploit
• https://lists.apache.org/thread/jvxs2kh2o60sl7qkl5nss4r5phzfl4cz · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-40564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40564 · Security Note
• https://bdu.fstec.ru/vul/2026-07535 · Security Note
• http://openwall.com/lists/oss-security/2026/05/26/6 · Note
• https://t.me/cveNotify/165467 · Telegram Post
• https://openwall.com/lists/oss-security/2026/05/26/6 · Note
• https://t.me/CVEtracker/54978 · Telegram Post
• https://twitter.com/oss_security/status/2059923943943745540 · Twitter Post