Live › vulnerability › CVE-2020-17519
Go to dashboardApache Flink's JobManager REST interface lets unauthenticated callers read arbitrary files from the JobManager host's local filesystem. An attacker can pull configuration files, credentials, and other sensitive data from the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache flink | vendor | >= 1.11.0, < 1.11.3 | 1.11.3 |
| Apache Flink | vendor | – | – |
Unknown from the sources.
Upgrade Apache Flink to a version that includes the fix for CVE-2020-17519 (fixed versions not stated in sources); or follow the vendor mitigation instructions referenced by CISA.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
This page as .md · .json · in your agent: get_signal("CVE-2020-17519")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.