CVE-2020-17519 Apache Flink
| Affected software | Apache Flink |
|---|---|
| Severity | 9.1 Critical CVSS 3.1 3 scores |
| Fixed in | 1.11.3 |
| Weakness | Path traversal (CWE-22) |
| Published | 5 Jan 2021 |
| Updated | 17 Jun 2026 |
Description
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
CWE-552
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2024-05-23 · remediation due 2024-06-13 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 5 citations · honeypot sightings · 12 exploits · earliest 2021-04-12.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
- Indexed PoC 13 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2021-01-06.
- EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-17519 in VulnCheck (free account), which lists 7 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 791 days | 2023-11-13 to 2026-11-12 |
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 45 days | 2026-04-30 to 2026-11-12 |
| Reported exploitation | unit42.paloaltonetworks.com | /network-attack-trends-winter-2020 | 2021-04-12 |
| Reported exploitation | 1665891.fs1.hubspotusercontent-na1.net | /hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf | 2024-05-10 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2024-05-23 |
| Reported exploitation | info.greynoise.io | /hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf | 2025-02-27 |
| Reported exploitation | app.crowdsec.net | /cti/cve-explorer/CVE-2020-17519 | 2025-06-07 |
| Exploit reference | VulnCheck XDB 1b1d6d820b0c | Exploit type: infoleak | 2021-01-06 |
| Exploit reference | VulnCheck XDB 7c9fe2b962fd | Exploit type: info-leak | 2021-01-06 |
| Exploit reference | VulnCheck XDB 7fe03bf0f0a6 | Exploit type: infoleak | 2021-01-06 |
| Exploit reference | VulnCheck XDB 7159401b812c | Exploit type: info-leak | 2021-01-08 |
| Exploit reference | VulnCheck XDB c096ce6f775b | Exploit type: info-leak | 2021-01-10 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Tool check: CVE-2021-41773, CVE-2021-42013, CVE-2020-17519 | 61 | 2021-10-13 |
| Nuclei | Apache Flink - Local File Inclusion | ||
| Exploit-DB | Apache Flink 1.11.0 - Unauthenticated Arbitrary File Read (Metasploit) | 2021-01-08 | |
| GitHub PoC | Apache Flink 目录遍历漏洞批量检测 (CVE-2020-17519) | 46 | 2021-01-06 |
| GitHub PoC | [CVE-2020-17519] Apache Flink RESTful API Arbitrary File Read | 8 | 2021-01-10 |
| GitHub PoC | Apache Flink Directory Traversal (CVE-2020-17519) Nmap NSE Script | 3 | 2021-01-06 |
| GitHub PoC | CVE-2020-17519 Cheetah | 1 | 2021-04-13 |
| GitHub PoC | CVE-2020-17519; Apache Flink 任意文件读取; 批量检测 | 1 | 2021-01-18 |
| GitHub PoC | QmF0c3UK/CVE-2020-17519 | 1 | 2021-01-06 |
| GitHub PoC | Vulhub flink/CVE-2020-17519: Apache Flink JobManager Directory Traversal (CVE-2020-17519), run with Isoloom | 2026-10-08 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Path traversal
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR path-traversal security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-22: Path Traversal. |
How to mitigate CVE-2020-17519
Upgrade Apache Flink to 1.11.3 or later. Until you can, Waratek RASP blocks exploitation with its path traversal rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.1 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
3 metrics
CVSS
9.1 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
CISA-ADP | Secondary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.flink:flink-runtime_2.11 |
1.11.0 | 1.11.3 |
unbounded |
org.apache.flink:flink-runtime_2.12 |
1.11.0 | 1.11.3 |
unbounded |
Products and versions
3 products, 3 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | flink | generic | ≥ 1.11.0 and ＜ 1.11.3 |
| osv | org.apache.flink | flink-runtime_2.11 | generic | ≥ 1.11.0 and ＜ 1.11.3 |
| osv | org.apache.flink | flink-runtime_2.12 | generic | ≥ 1.11.0 and ＜ 1.11.3 |
References
Timeline
Timeline
| Published | 2021-01-05 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2021-04-12 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2024-05-23 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |