CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
Attackers with CR create permissions can exploit unvalidated URIs to read local files and access internal network resources via SSRF.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40564?
CVE-2026-40564 is a medium-severity server-side request forgery vulnerability in Apache Flink Kubernetes Operator, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.
The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.
Users are recommended to upgrade to version 1.15.0, which fixes the issue.
Which versions are affected by CVE-2026-40564?
It affects 1 product.
Products include Apache Flink Kubernetes Operator.
How do I fix CVE-2026-40564?
No fix has been published for CVE-2026-40564 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-40564 being exploited?
There is no known exploitation of CVE-2026-40564 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-rj6x-mg28-wf4x.