CVE-2026-40564

CVE-2026-40564: flink-kubernetes-operator における FlinkSessionJob.spec.job.jarURI 経由の SSRF Apache Flink Kubernetes Operator は、FlinkSessionJobまたは FlinkDeploymentリソース上の spec.job.jarURI フィールドをチェックしません。これらのリソースを作成できる人は誰でも、jarURI を任意の URL に設定できます。Operator がリソースを調整reconcileする際、自身の Pod 内部からその URL...

CVE-2026-40564

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

Apache Flink Kubernetes Operator 安全漏洞

Apache Flink Kubernetes Operator is an operations component for Flink clusters developed by the Apache Foundation. Versions of Apache Flink Kubernetes Operator from 1.3.0 to 1.15.0 contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of the jarURI in...