Executive brief
Apache Flink Kubernetes Operator is a tool used to manage and automate the deployment of Flink data processing applications on Kubernetes. A security vulnerability allows users with permission to create job resources to trick the system into reading sensitive files from the server's local storage or accessing internal network services. This could lead to the exposure of private configuration data or unauthorized access to internal systems that are not normally reachable from the outside.
Technical details
The Apache Flink Kubernetes Operator fails to validate the 'jarURI' parameter in FlinkSessionJob resources. An attacker with permissions to create Custom Resources (CR) can provide a malicious URI to perform Server-Side Request Forgery (SSRF) or read local files from the operator pod's filesystem. The vulnerability exists because there is no allowlist for URI schemes, no host/IP range restrictions, and no validation to ensure the URI points to user-owned files. This allows the submitted Flink job to pull content from any backing store reachable via Flink's pluggable filesystem layer, including internal or link-local addresses. The issue is fixed in version 1.15.0.
Affected products
- Apache Flink Kubernetes Operator 1.3.0 to 1.14.0
Timeline
- 2026-05-26: disclosed
- 2026-05-26: advisory
- 2026-05-26: patched: Fixed in version 1.15.0