Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-40564

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.  This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetch
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:63050a3351c7fc750871b4ca4b31eea0171a10c1fb77bb45f3f9ac6a601ed28f
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-552","description":"CWE-552 Files or Directories Accessible to External Parties","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"Apache Flink Kubernetes Operator","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.15.0","status":"affected","version":"1.3.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/adp/1/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-552","description":"CWE-552 Files or Directories Accessible to External Parties","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"url":"http://www.openwall.com/lists/oss-security/2026/05/26/6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/adp/0/references/0
{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/jvxs2kh2o60sl7qkl5nss4r5phzfl4cz"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:fb75526ece5f9c4fd8a6b53cb29f490a45bd683a128ca7fde1067c816c7dcdc7 · sha256:19ccf46da2c9a0bd… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer