CVE-2026-40564

🗓️ 26 May 2026 14:38:21Reported by apacheType

cve🔗 web.nvd.nist.gov👁 31 Views🌐 WEB

SSRF and local file access in Flink Kubernetes Operator via unvalidated jarURI.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for CVE-2026-40564	29 May 202609:32	–	githubexploit
ATTACKERKB	CVE-2026-40564	26 May 202614:38	–	attackerkb
BDU FSTEC	The vulnerability of the FlinkSessionJob component in the automation tool for deploying, managing, and scaling a distributed data processing platform. This vulnerability allows attackers to gain unauthorized access to protected information.	1 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-40564	26 May 202615:20	–	circl
CNNVD	Apache Flink Kubernetes Operator 安全漏洞	26 May 202600:00	–	cnnvd
Cvelist	CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator	26 May 202614:38	–	cvelist
EUVD	EUVD-2026-31846	26 May 202614:38	–	euvd
NVD	CVE-2026-40564	26 May 202616:16	–	nvd
OSV	CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator	26 May 202614:38	–	osv
Packet Storm	📄 Apache Flink Kubernetes Operator 1.14.0 Server-Side Request Forgery	16 Jun 202600:00	–	packetstorm

NVD

Vulners

Node

apache flink_kubernetes_operatorRange1.3.0–1.15.0

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Flink Kubernetes Operator",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.15.0",
        "status": "affected",
        "version": "1.3.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/jvxs2kh2o60sl7qkl5nss4r5phzfl4cz
openwall	www.openwall.com/lists/oss-security/2026/05/26/6

Parameter	Position	Path	Description	CWE
jarURI	nested	169.254.169.254/latest/meta-data/	SSRF via jarURI pointing to AWS EC2 instance metadata service	CWE-918, CWE-552
jarURI	nested	169.254.169.254/latest/meta-data/iam/security-credentials/	SSRF via jarURI to AWS IAM credentials metadata	CWE-918, CWE-552
jarURI	nested	169.254.169.254/latest/user-data/	SSRF via jarURI to AWS user-data metadata	CWE-918, CWE-552
jarURI	nested	169.254.169.254/latest/dynamic/instance-identity/document	SSRF via jarURI to AWS instance identity document	CWE-918, CWE-552
jarURI	nested	http://169.254.169.254/latest/meta-data/iam/security-credentials/	SSRF via jarURI to in-cluster metadata service (IPv4 address local to cloud)	CWE-918, CWE-552
jarURI	nested	http://10.0.0.1:6443/api	SSRF via jarURI to internal Kubernetes API server or internal endpoint	CWE-918, CWE-552
jarURI	nested	file:///etc/passwd	SSRF via jarURI to local filesystem (read local files through filesystem fetcher)	CWE-918, CWE-552
jarURI	nested	s3://attacker-bucket/x.jar	SSRF via jarURI to S3, using operator pod credentials	CWE-918, CWE-552
jarURI	nested	https://webhook.site//exploit.jar	POC URL used to proof SSRF via jarURI	CWE-918, CWE-552

24 Jul 2026 11:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.0049

SSVC