CVE-2026-40564 Details
Description
Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0. Users are recommended to upgrade to version 1.15.0, which fixes the issue.
A server-side request forgery (SSRF) vulnerability has been identified in the Apache Flink Kubernetes Operator, affecting versions 1.3.0 prior to 1.15.0. The vulnerability arises because the FlinkSessionJob jarURI is not properly validated, allowing users with create permissions to read files from the operator pod's filesystem. Additionally, content can be pulled from any backing store accessible through Flink's pluggable filesystem layer and accessed via the submitted Flink job. The vulnerability also allows fetching from http or https addresses without any restrictions on the URI scheme, host, IP range, or protections against internal or link-local addresses.
Users are advised to upgrade to Apache Flink Kubernetes Operator version 1.15.0 or later, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/26/6 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/jvxs2kh2o60sl7qkl5nss4r5phzfl4cz | [email protected] | Mailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache flink kubernetes operator | >= 1.3.0, < 1.15.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CVE |
| May 26, 2026 | New CVE Received | [email protected] |