CVE-2026-40564

CVE-2026-40564 : SSRF via FlinkSessionJob.spec.job.jarURI dans flink-kubernetes-operator L'opérateur Kubernetes Apache Flink ne vérifie pas le champ spec.job.jarURI sur les ressources FlinkSessionJob ou FlinkDeployment. Toute personne capable de créer l'une de ces ressources peut définir jarURI s...

CVE-2026-40564

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

Apache Flink Kubernetes Operator 安全漏洞

Apache Flink Kubernetes Operator is an operations component for Flink clusters developed by the Apache Foundation. Versions of Apache Flink Kubernetes Operator from 1.3.0 to 1.15.0 contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of the jarURI in...