The Apache Flink Kubernetes Operator contains a vulnerability (CVE-2026-40564) where the FlinkSessionJob jarURI parameter is insufficiently validated. This allows an attacker with create permissions to read arbitrary files from the operator pod's filesystem or from any backing store accessible through Flink's pluggable filesystem layer. Furthermore, the lack of URI scheme allowlisting, host validation, and IP-range restrictions for HTTP/HTTPS URIs enables potential server-side request forgery (SSRF) attacks targeting internal or link-local network addresses. This affects versions 1.3.0 through before 1.15.0. The vulnerability is addressed in version 1.15.0.

An attacker with create permissions can exploit this vulnerability to read sensitive files from the operator pod's filesystem or from external backing stores accessible via the Flink pluggable filesystem. Additionally, the attacker can perform SSRF attacks by specifying HTTP/HTTPS URIs without restrictions, potentially accessing internal or link-local network resources. This could lead to unauthorized information disclosure. There is no indication of integrity or availability impact. The CVSS score of 6.5 reflects a medium severity impact focused on confidentiality.

Users should upgrade Apache Flink Kubernetes Operator to version 1.15.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is not explicitly stated but the vendor recommends upgrading to 1.15.0 to address the issue.