Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)

Summary This security vulnerability in the AssertJ library used within IBM Event Processing could allow an attacker to exploit specially crafted XML input to cause local file disclosure, server-side request forgery SSRF, or denial of service in Java-based components running on the Apache Flink...

ai.chronon:flink_2.12 (>=0.0.62 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91), ai.chronon:online_2.11 (>=0.0.25 <=revert-391-thread-0.0.24) +6989 more potentially affected by CVE-2026-33558 via org.apache.kafka:kafka-clients (>=0.11.0.0 <=3.9.1)

org.apache.kafka:kafka-clients MAVEN version =0.11.0.0, =0.0.62, =0.0.25, =0.0.25, =0.0.25, =0.0.86, =0.0.86, =0.0.1, =0.0.1, =thread-pool-0.0.24-dev, =0.0.6, =1.0.6, =1.0.6, =0.0.2, =0.3.0 and more Source cves: CVE-2026-33558 Source advisory: SNYK:JAVA-ORGAPACHEKAFKA-16300072...

CVE-2026-34479 vulnerabilities

Vulnerabilities for packages: spark, akhq, druid, celeborn, flink, logstash, solr, kafka, kserve-modelmesh, sonarqube...

GHSA-H383-GMXW-35V2 vulnerabilities

Vulnerabilities for packages: spark, akhq, druid, celeborn, flink, logstash, solr, kafka, kserve-modelmesh, sonarqube...

CVE-2026-34479 vulnerabilities

Vulnerabilities for packages: logstash-fips, kafka, opensearch, geoserver, spark-fips, solr, celeborn, elasticsearch, akhq, logstash, flink, spark, commercial-elasticsearch, pinot-fips, sonarqube, pinot, druid, kserve-modelmesh, nuxeo, kafka-fips, elasticsearch-fips...

GHSA-H383-GMXW-35V2 vulnerabilities

Vulnerabilities for packages: logstash-fips, kafka, opensearch, geoserver, spark-fips, solr, celeborn, elasticsearch, akhq, logstash, flink, spark, commercial-elasticsearch, pinot-fips, sonarqube, pinot, druid, kserve-modelmesh, nuxeo, kafka-fips, elasticsearch-fips...

CVE-2026-34481 vulnerabilities

Vulnerabilities for packages: spark, strimzi-kafka-operator, apache-pulsar, neo4j, flink, solr...

CVE-2026-34481 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator-fips, neo4j, wso2is, camunda-zeebe, camunda, kafka-bridge-fips, spark-kubernetes-operator, apache-pulsar, apache-camel-karavan-devmode, spark-fips, solr, spark, flink, kafka-bridge, apache-pulsar-fips, strimzi-kafka-operator...

GHSA-W35J-PV5H-Q9Q9 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator-fips, neo4j, wso2is, camunda-zeebe, camunda, kafka-bridge-fips, spark-kubernetes-operator, apache-pulsar, apache-camel-karavan-devmode, spark-fips, solr, spark, flink, kafka-bridge, apache-pulsar-fips, strimzi-kafka-operator...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: kafka, opensearch, tritonserver-backend-vllm-cuda-13.0, camunda, geoserver, kafka-bridge-fips, apache-activemq-artemis, infinispan, apache-hop, spark-fips, apache-tika, solr, celeborn, neo4j, elasticsearch, akhq, apache-jena-fuseki, apache-activemq,...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: kafka, opensearch, tritonserver-backend-vllm-cuda-13.0, camunda, geoserver, kafka-bridge-fips, apache-activemq-artemis, infinispan, apache-hop, spark-fips, apache-tika, solr, celeborn, neo4j, elasticsearch, akhq, apache-jena-fuseki, apache-activemq,...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: akhq, celeborn, apache-tika, neo4j, wavefront-proxy, solr, kserve-modelmesh, spark, opensearch, sonarqube, infinispan, apache-pulsar, apache-activemq-artemis, kafka, airflow, zipkin, strimzi-kafka-operator, druid, flink, logstash...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: akhq, celeborn, apache-tika, neo4j, wavefront-proxy, solr, kserve-modelmesh, spark, opensearch, sonarqube, infinispan, apache-pulsar, apache-activemq-artemis, kafka, airflow, zipkin, strimzi-kafka-operator, druid, flink, logstash...

CLEANSTART-2026-ZR74513 Security fixes for CVE-2025-68161 applied in versions: 2.2.0-r0

Security vulnerability affects the flink package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-3052

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

CVE-2026-3052

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

CVE-2026-3052 DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

EUVD-2026-7433

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

CVE-2026-3052 DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

CVE-2026-3052

DataLinkDC dinky up to 1.2.5 is affected. The vulnerable component is the Flink Proxy Controller (dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java) and its proxyUba function. The issue enables server-side request forgery (SSRF) and is exploitable remotely. The exploit has ...