Improper Access Control in Apache Flink (CVE‑2020‑17519) Enables Arbitrary File Read via REST Interface
What It Is – Apache Flink 1.11.0‑1.13.2 contains an improper access‑control flaw in its JobManager REST API that permits any unauthenticated requester to read arbitrary files from the host’s local filesystem.
Exploitability – The vulnerability is publicly disclosed; proof‑of‑concept requests have been shared, giving it a CVSS v3.1 base score of 7.5 (High). No known active exploit campaigns have been reported, but the attack requires only network access to the REST endpoint.
Affected Products – Apache Flink (all versions prior to the 1.13.3 security release).
Why It Matters for Trust & Control Assurance
- Access‑Control Assurance – The flaw demonstrates a gap in the “least‑privilege” control objective; continuous verification of authentication and authorization settings is essential for audit readiness.
- Evidence of Defensible Monitoring – Detecting unauthorized REST calls and logging file‑read attempts provides the audit evidence demanded by regulators and enterprise buyers.
- Supply‑Chain Trust – Many cloud‑native data pipelines embed Flink; a single mis‑configured component can undermine the trust posture of an entire service stack.
Recommended Actions
- Apply the Apache Flink 1.13.3 (or later) security patch immediately.
- Restrict JobManager REST access to trusted networks or VPNs; enforce mutual TLS where possible.
- Enable detailed request logging and integrate logs into a SIEM for continuous monitoring.
- Conduct a post‑patch validation of file‑system permissions and perform a control‑objective audit against the “Access Control” area of the Verisq Common Framework (VCF).
Source: CISA KEV – CVE‑2020‑17519