Actively exploited in the wild

Apache Flink Improper Access Control Vulnerability

Apache - Flink · Listed in the CISA KEV since 2024-05-23. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2020-17519

HighCVSS 7.5KEV

Published: 05/01/2021(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A change introduced in Apache Flink 1.11.0 allows attackers to read any file on the local filesystem of the JobManager through the REST interface. Access is restricted to files accessible by the JobManager process. The issue was fixed in Flink 1.11.3 and 1.12.0.

Risk Assessment

An attacker could read sensitive files from the server, potentially leading to data leakage including credentials or configuration. However, network access to the JobManager REST interface is required.

Recommendation

Upgrade Apache Flink to version 1.11.3 or 1.12.0 as soon as possible. If upgrade is not possible, restrict network access to the JobManager REST interface.

Other vulnerabilities in Apache Flink

CVE-2026-35194High
Apache Flink versions 1.15.0 through 1.20.x and 2.0.0 through 2.x have a code injection vulnerability in SQL code generation. Authenticated users with query submission privileges can execute arbitrary code on TaskManagers via maliciously crafted SQL queries.

Original NVD description (English source)

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.