From 0dc918f7f7ad301eaa5f8a10941426ab7e6801fa Mon Sep 17 00:00:00 2001 From: Gabor Somogyi Date: Mon, 1 Jun 2026 13:57:21 +0200 Subject: [PATCH] Rewrite security page with precise trust model and operator coverage --- docs/content/what-is-flink/security.md | 160 +++++++++++-------------- 1 file changed, 70 insertions(+), 90 deletions(-) diff --git a/docs/content/what-is-flink/security.md b/docs/content/what-is-flink/security.md index 02d5645557..81f16cfbcb 100644 --- a/docs/content/what-is-flink/security.md +++ b/docs/content/what-is-flink/security.md @@ -27,93 +27,73 @@ under the License. # Security -## Security Updates - -This section lists fixed vulnerabilities in Flink. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
CVE IDAffected Flink versionsNotes
- CVE-2020-1960 - - 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 - - Users are advised to upgrade to Flink 1.9.3 or 1.10.1 or later versions or remove the port parameter from the reporter configuration (see advisory for details). -
- CVE-2020-17518 - - 1.5.1 to 1.11.2 - - Fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4
- Users are advised to upgrade to Flink 1.11.3 or 1.12.0 or later versions. -
- CVE-2020-17519 - - 1.11.0, 1.11.1, 1.11.2 - - Fixed in commit b561010b0ee741543c3953306037f00d7a9f0801
- Users are advised to upgrade to Flink 1.11.3 or 1.12.0 or later versions. -
- CVE-2023-41834 - - Flink Stateful Functions 3.1.0, 3.1.1, 3.2.0 - - Fixed in commit b06c0a23a5a622d48efc8395699b2e4502bd92be
- Users are advised to upgrade to Flink Stateful Functions 3.3.0 or later versions. -
- CVE-2026-35194 - - 1.15.0 through 1.20.x and 2.0.0 through 2.x - - Fixed in commit b06c0a23a5a622d48efc8395699b2e4502bd92be, e7c0d17074dc0dc9e102a072f11bf0de09ba01a5 and 9b2a11268dc8b4e6ea5a604dca0ea27f0fee3ed8
- Users are advised to upgrade to Flink 1.20.4, 2.0.2, 2.1.2 or 2.2.1. -
- - -## Frequently Asked Questions - -### During a security analysis of Flink, I noticed that Flink allows for remote code execution, is this an issue? - -Apache Flink is a framework for executing user-supplied code in clusters. Users can submit code to Flink processes, which will be executed unconditionally, without any attempts to limit what code can run. Starting other processes, establishing network connections or accessing and modifying local files is possible. - -Historically, we've received numerous remote code execution vulnerability reports, which we had to reject, as this is by design. - -**We strongly discourage users to expose Flink processes to the public internet**. Within company networks or "cloud" accounts, we recommend restricting access to a Flink cluster via appropriate means. - - -### I found a vulnerability in Flink, how do I report it? - -Thanks a lot for looking into the security of Apache Flink! We appreciate reports improving the security of Flink. We accept vulnerability reports through the [Apache Security Team](https://www.apache.org/security/), via their private email address [security@apache.org](mailto:security@apache.org). - -If you want to discuss a potential security issue privately with the Flink PMC, you can reach us also via [private@flink.apache.org](mailto:private@flink.apache.org). +## Apache Flink + +Apache Flink is a distributed stream and batch processing framework that executes user-supplied code across a cluster of machines. + +### Trust Boundary + +Flink's security model is built around one explicit trust boundary: **the cluster operator is trusted; the cluster network interfaces are not public**. + +**Authenticated users who submit jobs are fully trusted.** Flink executes submitted code unconditionally. A job can spawn processes, open network connections, read and write local files, and perform any operation the operating system permits. This is intentional -- restricting what user code can do would prevent legitimate use cases. Flink is not a sandbox. + +**Unauthenticated access to cluster interfaces is the threat Flink protects against.** The REST API, SQL Gateway, and BLOB server are the surfaces that must be secured from external attackers. + +### Security Boundary Reference + +The table below is intended for security researchers and enterprise security teams evaluating Flink: + +| Scenario | Security boundary | Notes | +|---|---|---| +| Unauthenticated access to the REST API | **In scope** | Vulnerability -- report it | +| Path traversal or unauthorized file access via REST API | **In scope** | Vulnerability -- report it | +| SQL injection or auth bypass via SQL Gateway | **In scope** | Vulnerability -- report it | +| Credential or secret exposure in cluster interfaces | **In scope** | Vulnerability -- report it | +| RCE via an authenticated, submitted user job | **Out of scope** | By design -- authenticated users run arbitrary code | +| Spawning processes or opening connections from within a running job | **Out of scope** | By design | +| Reading or writing files from within a running job | **Out of scope** | By design | + +### Deployment Requirements + +Flink clusters must not be exposed to the public internet. Access to all Flink network interfaces must be restricted to trusted principals via network-level controls (firewalls, security groups, VPN). + +SSL/TLS, REST API authentication, and SQL Gateway authentication are all **disabled by default**. A default Flink deployment is unauthenticated and unencrypted on its network interfaces. These must be explicitly configured before any production or shared deployment. + +Flink does not manage the security of external systems it connects to, nor the lifecycle of credentials used to connect to them -- those are operator responsibilities. + +## Flink Kubernetes Operator + +The [Flink Kubernetes Operator](https://nightlies.apache.org/flink/flink-kubernetes-operator-docs-stable/) is the standard deployment mechanism for Flink on Kubernetes. Its security model extends the Flink model above -- both apply when the operator is in use. + +### Trust Boundary + +The Kubernetes RBAC layer replaces direct cluster access as the authentication mechanism. Any principal with permission to apply Flink custom resources (`FlinkDeployment`, `FlinkSessionJob`) is the equivalent of an authenticated Flink user -- they can submit arbitrary jobs with full execution trust. The operator's own service account is trusted by the Kubernetes control plane with cluster-scoped permissions. + +### Security Boundary Reference + +| Scenario | Security boundary | Notes | +|---|---|---| +| Using the operator API to access resources beyond the submitting principal's own permissions | **In scope** | Vulnerability -- report it | +| Credential exposure via Flink custom resource spec or status fields | **In scope** | Vulnerability -- report it | +| Webhook bypass allowing malformed or malicious resources to be applied | **In scope** | Vulnerability -- report it | +| Information disclosure via operator logs or metrics | **In scope** | Vulnerability -- report it | +| A principal with Flink custom resource apply permission submitting a malicious job | **Out of scope** | By design -- same trust model as authenticated job submission | +| RBAC misconfiguration by the cluster administrator | **Out of scope** | Operator responsibility | + +### Deployment Requirements + +The operator runs with cluster-scoped RBAC by default -- apply least-privilege principles and restrict its service account to the minimum required permissions. The admission webhook requires TLS, which Kubernetes enforces. Credentials in Flink custom resource specifications flow through Kubernetes secrets and must be managed according to your organization's secret management policies. Restrict Flink custom resource apply permissions to trusted principals. + +## Known Vulnerabilities + +The Flink project does not maintain its own CVE list. For a complete and up-to-date record of known vulnerabilities, consult the authoritative external databases: + +- [OSV](https://osv.dev) -- package-aware, used by Dependabot, Snyk, and osv-scanner +- [NVD](https://nvd.nist.gov) -- NIST's authoritative CVE database + +## Reporting a Vulnerability + +If you discover a vulnerability in Flink's own infrastructure, please report it privately through one of the following channels: + +- **Apache Security Team:** [security@apache.org](mailto:security@apache.org) -- preferred for CVE assignment and coordinated disclosure +- **Flink PMC (private):** [private@flink.apache.org](mailto:private@flink.apache.org) -- for direct discussion with the Flink PMC