What it is
Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Apache entries on the list
- Struts Apache Struts Command Injection Vulnerability CVE-2016-3081 · Oct 8, 2026
- Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CVE-2026-34486 · Aug 4, 2026
- ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability CVE-2026-34197 · Apr 16, 2026
- HTTP Server Apache HTTP Server Improper Escaping of Output Vulnerability CVE-2024-38475 · May 1, 2025
- Tomcat Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813 · Apr 1, 2025
- OFBiz Apache OFBiz Forced Browsing Vulnerability CVE-2024-45195 · Feb 4, 2025