CVE-2026-40564

CVE-2026-40564 : SSRF via FlinkSessionJob.spec.job.jarURI dans flink-kubernetes-operator L'opérateur Kubernetes Apache Flink ne vérifie pas le champ spec.job.jarURI sur les ressources FlinkSessionJob ou FlinkDeployment. Toute personne capable de créer l'une de ces ressources peut définir jarURI s...

CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...