{"id":"CVE-2020-17519","published":"2021-01-05T12:15:12Z","modified":"2026-06-17T02:59:04Z","title":"Apache Flink Improper Access Control Vulnerability","vendor":"Apache","product":"Flink","tier":"core","eol":null,"description":{"text":"A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.","provenance":"source","from":"NVD"},"summary":{"text":"Apache Flink versions 1.11.0, 1.11.1 and 1.11.2 contain an improper access control flaw in the JobManager's REST interface, which exposes files on its local filesystem. An unauthenticated remote attacker with network access to the JobManager REST endpoint can read any file the JobManager process itself can access, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:54Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.98001,"percentile":0.99909,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-05-23","dueDate":"2024-06-13","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/typ0h03zyfrzjqlnb7plh64df1g2383d; https://nvd.nist.gov/vuln/detail/CVE-2020-17519","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-12","exploitedFirstSeen":"2021-04-12","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-22&host_type=src&vulnerability=cve-2020-17519","date":"2023-11-22"}],"evidenceTotal":786,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties"}],"references":[{"url":"http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/05/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r0a433be10676f4fe97ca423d08f914e0ead341c901216f292d2bbe83%40%3Cissues.flink.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1%40%3Cdev.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r2fc60b30557e4a537c2a6293023049bd1c49fd92b518309aa85a0398%40%3Cissues.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r4e1b72bfa789ea5bc20b8afe56119200ed25bdab0eb80d664fa5bfe2%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cannounce.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cuser.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r88b55f3ebf1f8f4e1cc61f030252aaef4b77060b56557a243abb92a1%40%3Cissues.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r88f427865fb6aa6e6378efe07632a1906b430365e15e3b9621aabe1d%40%3Cissues.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E","tags":["Mailing List","Not Applicable"]},{"url":"https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b4449beb2a38d1ce28fd89001f%40%3Cdev.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/05/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r0a433be10676f4fe97ca423d08f914e0ead341c901216f292d2bbe83%40%3Cissues.flink.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1%40%3Cdev.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r2fc60b30557e4a537c2a6293023049bd1c49fd92b518309aa85a0398%40%3Cissues.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r4e1b72bfa789ea5bc20b8afe56119200ed25bdab0eb80d664fa5bfe2%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cannounce.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cuser.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread.html/r88b55f3ebf1f8f4e1cc61f030252aaef4b77060b56557a243abb92a1%40%3Cissues.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r88f427865fb6aa6e6378efe07632a1906b430365e15e3b9621aabe1d%40%3Cissues.flink.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E","tags":["Mailing List","Not Applicable"]},{"url":"https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b4449beb2a38d1ce28fd89001f%40%3Cdev.flink.apache.org%3E","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17519","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated attacker exploits exposed REST interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows attackers to read any file on the local filesystem of the JobManager through the REST interface","start":87,"end":189}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Direct arbitrary local file read impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows attackers to read any file on the local filesystem of the JobManager","start":87,"end":162}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.flink:flink-runtime_2.11","vulnerableRanges":[">=1.11.0, <1.11.3"],"patched":["1.11.3"],"from":["GHSA-395w-qhqr-9fr6"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.flink:flink-runtime_2.12","vulnerableRanges":[">=1.11.0, <1.11.3"],"patched":["1.11.3"],"from":["GHSA-395w-qhqr-9fr6"],"provenance":"source"}],"advisories":[{"id":"GHSA-395w-qhqr-9fr6","url":"https://github.com/advisories/GHSA-395w-qhqr-9fr6","severity":"HIGH","ecosystem":"Maven","package":"org.apache.flink:flink-runtime_2.11","vulnerableRanges":[">=1.11.0, <1.11.3"],"patched":["1.11.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-395w-qhqr-9fr6","url":"https://github.com/advisories/GHSA-395w-qhqr-9fr6","severity":"HIGH","ecosystem":"Maven","package":"org.apache.flink:flink-runtime_2.12","vulnerableRanges":[">=1.11.0, <1.11.3"],"patched":["1.11.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0481","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0481","exploited":true,"exploitedSince":"2024-05-23","provenance":"source"},"exploits":[{"id":49398,"url":"https://www.exploit-db.com/exploits/49398","title":"Apache Flink 1.11.0 - Unauthenticated Arbitrary File Read (Metasploit)","type":"webapps","platform":"java","date":"2021-01-08","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2021-01-08"},"pocGithub":{"count":11,"skipped":3,"earliest":"2021-01-06","earliestUrl":"https://github.com/B1anda0/CVE-2020-17519","repos":[{"name":"MrCl0wnLab/SimplesApachePathTraversal","url":"https://github.com/MrCl0wnLab/SimplesApachePathTraversal","stars":61,"created":"2021-10-13"},{"name":"B1anda0/CVE-2020-17519","url":"https://github.com/B1anda0/CVE-2020-17519","stars":47,"created":"2021-01-06"},{"name":"murataydemir/CVE-2020-17519","url":"https://github.com/murataydemir/CVE-2020-17519","stars":8,"created":"2021-01-10"},{"name":"dolevf/apache-flink-directory-traversal.nse","url":"https://github.com/dolevf/apache-flink-directory-traversal.nse","stars":3,"created":"2021-01-06"},{"name":"QmF0c3UK/CVE-2020-17519","url":"https://github.com/QmF0c3UK/CVE-2020-17519","stars":1,"created":"2021-01-06"}]},"metasploit":[{"name":"Apache Flink JobManager Traversal","module":"auxiliary/scanner/http/apache_flink_jobmanager_traversal","type":"auxiliary","disclosureDate":"2021-01-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_flink_jobmanager_traversal.rb"}],"nuclei":[{"id":"CVE-2020-17519","name":"Apache Flink - Local File Inclusion","severity":"high","path":"http/cves/2020/CVE-2020-17519.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17519.yaml"}],"first":{"date":"2021-01-05","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_flink_jobmanager_traversal.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2021-01-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17519","provenance":"source"},{"date":"2021-01-05","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-01-06, Exploit-DB 2021-01-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_flink_jobmanager_traversal.rb","provenance":"source"},{"date":"2021-04-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","provenance":"source"},{"date":"2024-05-23","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-05-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0481","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1234},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2028 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 11 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}