Apache Software Foundation Flink vulnerabilities

• apache flink kubernetes operator Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator CVE-2026-40564 Public exploit 6.5 MediumMay 26, 2026
• apache flink Apache Flink: Remote code execution via SQL injection in code generation CVE-2026-35194 Public exploitFix available 8.1 HighMay 15, 2026
• apache flink cdc Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers CVE-2025-62228 Fix available 5.1 MediumOctober 9, 2025
• apache flink stateful functions Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences CVE-2023-41834 6.1 MediumSeptember 19, 2023
• apache flink Apache Flink directory traversal attack: reading remote files through the REST API CVE-2020-17519 In KEVPublic exploitFix available EPSS 98.0% 7.5 HighJanuary 5, 2021
• apache flink Apache Flink directory traversal attack: remote file writing through the REST API CVE-2020-17518 Public exploitFix available EPSS 49.4% 7.5 HighJanuary 5, 2021
• apache flink Command injection in Apache Flink CVE-2020-1960 Fix available 4.7 MediumMay 14, 2020