CVE-2026-40564

CVE-2026-40564: SSRF via FlinkSessionJob.spec.job.jarURI in flink-kubernetes-operator The Apache Flink Kubernetes Operator does not check the spec.job.jarURI field on FlinkSessionJob or FlinkDeployment resources. Anyone who can create one of those resources can set jarURI to any URL. When the...

CVE-2026-80351

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

EUVD-2026-75291

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351

Apache Camel K is affected by an eval injection vulnerability (CVE-2026-80351) in its dynamically evaluated Maven configuration. Tenant-controlled repository content can influence code execution within the operator pod , potentially allowing tenants to run arbitrary code with operator-level privi...

CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...