https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:44:06 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07535 bdu:2026-07535 https://cve.radiocsirt.org/vuln/bdu:2026-07535 https://cve.radiocsirt.org/vuln/euvd-2026-323917 EUVD-2026-323917 https://cve.radiocsirt.org/vuln/euvd-2026-323917 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40564 <p>Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.</p> <p>The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.  This lets a user with CR create permissions read files from the operator pod&#39;s filesystem and pull content from any backing store reachable through Flink&#39;s pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.</p> <p>Users are recommended to upgrade to version 1.15.0, which fixes the issue.</p> <p>Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.</p> <p>The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.  This lets a user with CR create permissions read files from the operator pod&#39;s filesystem and pull content from any backing store reachable through Flink&#39;s pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.</p> <p>Users are recommended to upgrade to version 1.15.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40564 https://cve.radiocsirt.org/vuln/ghsa-rj6x-mg28-wf4x <p>Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.</p> <p>The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.  This lets a user with CR create permissions read files from the operator pod&#39;s filesystem and pull content from any backing store reachable through Flink&#39;s pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.</p> <p>Users are recommended to upgrade to version 1.15.0, which fixes the issue.</p> <p>Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.</p> <p>The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.  This lets a user with CR create permissions read files from the operator pod&#39;s filesystem and pull content from any backing store reachable through Flink&#39;s pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.</p> <p>Users are recommended to upgrade to version 1.15.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-rj6x-mg28-wf4x