# What’s New for Confluent Platform for Apache Flink This topic contains details about each Confluent Platform for Apache Flink® release. ## September 2026 This release includes patch releases for Confluent Manager for Apache Flink (CMF), covering all CMF versions that receive patches. ### Version 2.4.3 This release introduces CMF version 2.4.3, which provides the following fixes: - A statement deployed to a dedicated compute pool whose name collides with an existing `FlinkDeployment` no longer silently overwrites it and now returns an HTTP 409 error. - Service account floor and allowlist enforcement now also applies to compute pools and environment defaults (`computePoolDefaults` and `flinkApplicationDefaults`), not only applications. - Metadata sync now logs a warning instead of silently reapplying a CMF-managed service account. - Fixed an issue where upgrading from a pre-2.4 release with `helm upgrade --reuse-values` left CMF without permission to manage per-environment RBAC resources, causing environment creation and deletion to fail with an HTTP 422 error. - Fixed an issue where starting a statement from a savepoint could report a spurious conflict depending on whether a matching savepoint was attached or detached. - Updated the default Flink SQL image for new compute pools in the CMF UI to `1.19-cp12`. **CVE fixes** This release includes the following vulnerability fixes for CMF: - CVE-2026-101898, CVE-2026-101901, CVE-2026-101903, CVE-2026-101905, CVE-2026-101906, CVE-2026-101907, CVE-2026-101909 – axios vulnerabilities in the CMF UI, fixed by upgrading to 1.20.0. - CVE-2026-68497, CVE-2026-19032, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777 – Jackson vulnerabilities, fixed by upgrading jackson-bom to 2.21.7. - CVE-2026-102276, CVE-2026-102278 – brace-expansion vulnerabilities in the CMF UI, fixed by upgrading to 1.1.20 and 5.0.11. ### Version 2.3.3 This release introduces CMF version 2.3.3, which provides the following fixes: - Service account floor and allowlist enforcement now also applies to compute pools, not only applications. - Metadata sync now logs a warning instead of silently reapplying a CMF-managed service account. - Fixed an issue where CMF silently dropped configured connection-configuration extensions (extra allowed keys, classes, and configuration-provider classes) at runtime when building the Kafka and Schema Registry catalogs that statements use. - Metadata sync no longer logs the full application or statement spec, which can contain credentials through `flinkConfiguration`, when it skips a resource or fails to convert it. Metadata sync now logs only the resource ID. - Fixed a null pointer exception when starting an application from a savepoint. - CMF now trims the savepoint name and UID before the attachment check. - Starting a statement from a savepoint UID now correctly clears `startFromSavepoint` instead of leaving a stale value. - Fixed a spurious conflict caused by duplicate detached savepoint paths when resolving an `initialSavepointPath`. **CVE fixes** This release fixes the Jackson vulnerabilities CVE-2026-68497, CVE-2026-19032, and CVE-2026-83557 in CMF by upgrading jackson-bom to 2.21.6. ### Versions 2.2.3, 2.1.5, and 2.0.5 These releases introduce CMF versions 2.2.3, 2.1.5, and 2.0.5, which provide the following fixes: - Service account floor and allowlist enforcement now also applies to compute pools, not only applications. - Metadata sync now logs a warning instead of silently reapplying a CMF-managed service account. - CMF now accepts `FlinkEnvironment` create requests from Confluent for Kubernetes (CFK) 3.3.1 and later. These requests send the environment name only in `metadata.name`. If a request sets both the top-level name and `metadata.name`, CMF uses the top-level name. **CVE fixes** This release fixes the Jackson vulnerabilities CVE-2026-68497, CVE-2026-19032, and CVE-2026-83557 in CMF by upgrading jackson-bom to 2.21.6. ## August 2026 This release includes patch releases for Confluent Manager for Apache Flink (CMF) and the Confluent Platform for Apache Flink Kubernetes Operator. ### Version 2.4.2 This release introduces CMF version 2.4.2, which provides the following fixes: - Statements on shared compute pools no longer always run with a stateless upgrade mode. Stopping and resuming a statement no longer loses state. - Starting a SQL statement from a savepoint now correctly triggers a restart. - Fixed an issue where webhook validation errors from the Confluent Platform for Apache Flink Kubernetes Operator were not correctly forwarded to CMF, surfacing only as a generic deployment timeout. - Fixed a regression where updating an application could intermittently return an HTTP 422 error during routine reconciliation by the Confluent Platform for Apache Flink Kubernetes Operator. - A SQL statement no longer fails to compile because of unrelated, misconfigured catalogs. - Deleting an environment that has secret mappings no longer returns an HTTP 500 error. - Fixed an issue where paginated list endpoints could return results without a deterministic order, causing items to be duplicated or missing across pages. - Fixed the MCP server’s `get_flinkapplicationlogs` tool to read pod logs from the correct Kubernetes cluster. **CVE fixes** This release includes the following vulnerability fixes for CMF: - CVE-2026-59949 – lz4-java vulnerability, fixed by upgrading to 1.11.1. - CVE-2026-45799 – Wire vulnerability, fixed by pinning to 6.4.5. - CVE-2026-59903 – Netty vulnerability, fixed by upgrading netty-codec-http to 4.2.17.Final. - CVE-2026-64607 – Apache HttpClient5 connection-leak vulnerability, fixed by upgrading to 5.6.3. - CVE-2026-49844 – Log4j vulnerability, fixed by upgrading log4j-api to 2.25.5. - CVE-2026-54399 – Apache HttpComponents Core vulnerability, fixed by upgrading httpcore5 to 5.4.3. - CVE-2026-14257, CVE-2026-69152 – brace-expansion vulnerability in the CMF UI, fixed by upgrading to 1.1.18 and 5.0.9. - CVE-2026-16221, CVE-2026-18446 – fast-uri vulnerability in the CMF UI, fixed by upgrading to 4.1.2. - CVE-2026-73566 – tar vulnerability in the CMF UI, fixed by upgrading to 7.5.21. ### Confluent Platform for Apache Flink Kubernetes Operator 1.15.0-cp3 This release updates the Confluent Platform for Apache Flink Kubernetes Operator to version 1.15.0-cp3, which provides the following fixes: - A `FlinkSessionJob` no longer gets stuck in the `RECONCILING` state when a job finishes quickly with checkpointing enabled but no `state.checkpoints.dir` configured. - Suspending a job through an asynchronous cancellation no longer leaves the resource reporting the `UPGRADING` state indefinitely. - Fixed redeploy from a savepoint for suspended jobs. **CVE fixes** This release includes the following vulnerability fixes for the Confluent Platform for Apache Flink Kubernetes Operator: - CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, GHSA-mhm7-754m-9p8w, GHSA-r7wm-3cxj-wff9 – Jackson vulnerabilities, fixed by upgrading jackson-bom to 2.18.9. - CVE-2026-59949 – lz4-java vulnerability, fixed by pinning to 1.11.1. ## July 2026 This release includes a new minor release and patch releases for Confluent Manager for Apache Flink (CMF), new Confluent Platform for Apache Flink versions, a new Confluent Platform for Apache Flink Kubernetes Operator version, and Flink Connector Kafka patch releases. ### Version 2.4.1 This release introduces CMF version 2.4.1, which provides the following fixes: - Added support for Flink 2.2 deployments. - Fixed a login issue on the s390x images that prevented them from working in 2.4.0. - CMF no longer crashes when the Confluent Platform for Apache Flink Kubernetes Operator event watcher’s informer times out during startup. The watcher now logs a warning and retries in the background. - Interactive SQL statements now work on non-running shared compute pools. - If a SQL statement fails to parse due to a broken catalog, CMF now retries without that catalog. - Improved error messages for SQL statement compile errors. - An application whose name collides with an existing `FlinkDeployment` no longer silently overwrites it and now returns an error. - Updated the default Flink SQL image for new compute pools in the CMF UI to `1.19-cp10`. - Fixed environment-list resources tooltip flicker and environments breadcrumb target in the CMF UI. - Slide-out panels in the CMF UI now dock below the top bar. **CVE fixes** This release includes the following vulnerability fixes for CMF: - CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901 – Netty vulnerabilities, fixed by upgrading to 4.2.16.Final. - CVE-2026-54515, CVE-2026-59889, GHSA-mhm7-754m-9p8w – Jackson vulnerabilities, fixed by upgrading jackson-bom to 2.21.5. - CVE-2026-54291 – PostgreSQL JDBC driver vulnerability, fixed by upgrading to 42.7.12. - CVE-2026-34237 – MCP SDK wildcard CORS vulnerability, fixed by upgrading to 0.18.3. - GHSA-gcfj-64vw-6mp9 – axios vulnerability in the CMF UI, fixed by upgrading to 1.18.0. - CVE-2026-13149 – brace-expansion vulnerability in the CMF UI, fixed by upgrading to 1.1.16 and 5.0.7. - CVE-2026-59873 (critical), CVE-2026-59874 – tar vulnerabilities in the CMF UI, fixed by upgrading to 7.5.19. ### Confluent Platform for Apache Flink 2.2.0-cp2 This release introduces Confluent Platform for Apache Flink version 2.2.0-cp2, based on upstream Apache Flink 2.2. ### Confluent Platform for Apache Flink and Flink SQL patch releases The following Confluent Platform for Apache Flink and Flink SQL versions are now available with bug and vulnerability fixes: - 2.1.3-cp2 - 2.0.2-cp3 - 1.20.5-cp2 - 1.19.3-cp6 - 1.18.1-cp9 - 1.19-cp10 (Flink SQL) ### Version 2.4.0 This release introduces Confluent Manager for Apache Flink® (CMF) version 2.4.0, which provides the following new features and fixes: **Major New Features** - **Embedded MDS:** CMF can now run its own embedded Metadata Service (MDS) for authentication and authorization as an alternative to the broker-based Metadata Service (MDS) provided by Confluent Platform. This removes the requirement for deploying an external Metadata Service (MDS) or Confluent Platform cluster. See [Configure Embedded MDS for Confluent Manager for Apache Flink](installation/embedded-mds.md#cmf-embedded-mds). - **Built-in web UI:** CMF now includes a standalone web dashboard for managing all CMF resources. Managing Flink in Confluent Control Center is deprecated in this release. Existing functionality continues to work but does not receive new features. See [Configure the Confluent Manager for Apache Flink UI](installation/ui.md#cmf-ui-config). - **Artifact management:** Upload and version Flink job JAR files through the CMF REST API, store them in blob storage you provide (Amazon S3, Google Cloud Storage, Azure Blob Storage, or S3-compatible stores), and reference them from applications with `cmf://` URIs, without custom Docker images or sidecar download containers. The feature is opt-in with `cmf.artifacts.enabled`. See [Manage Artifacts in Confluent Manager for Apache Flink](configure/artifacts.md#cmf-artifacts). - **Environment catalog:** Every environment now has a writable environment catalog for registering Flink SQL user-defined functions and tables that use custom connectors with SQL DDL. The feature is opt-in with `cmf.sql.environmentCatalog.enabled`. See [Manage Environment Catalogs in Confluent Manager for Apache Flink](configure/environment-catalog.md#cmf-environment-catalog). - **User-defined functions for SQL:** Register scalar, table, and aggregate Java user-defined functions with `CREATE FUNCTION` and use them in Flink SQL statements. See [User-Defined Functions in Confluent Manager for Apache Flink](jobs/sql-statements/user-defined-functions.md#cmf-sql-udf). - **Custom connectors and formats for SQL:** Use custom Flink connectors and formats, such as change-data-capture sources or filesystem sinks, by uploading their JARs to artifact management and creating tables in the environment catalog. See [Custom Connectors and Formats in Confluent Manager for Apache Flink](jobs/sql-statements/custom-connectors.md#cmf-sql-custom-connectors). - **Periodic savepoints:** Schedule recurring savepoints on Flink applications and statements, or set defaults for a whole environment, with grandfather-father-son retention, blackout windows, jitter, and pin or unpin to protect individual savepoints from cleanup. Every savepoint now carries a `status.source` of `MANUAL`, `UPGRADE`, or `SCHEDULE`, and a bulk-delete endpoint lets you clean up old scheduled savepoints in one call. See [Schedule periodic savepoints](jobs/savepoints.md#cmf-periodic-savepoints). - **Application events:** CMF now provides the full range of Confluent Platform for Apache Flink Kubernetes Operator events through the application events API and the CMF UI **Events log** tab on the application detail page, instead of only job exceptions. Kubernetes Operator events include deployment and validation errors, image-pull failures, container crash loops, and autoscaler activity. Recurring events are aggregated into a single record with an occurrence `count` and a most-recent-occurrence time, so a repeatedly failing application no longer floods the event history. See [Event tracking in Confluent Manager for Apache Flink](jobs/applications/events.md#cmf-events). - **MCP server:** AI agents and coding assistants can now inspect and manage Flink resources through a Model Context Protocol (MCP) server that runs alongside the CMF REST API and Confluent CLI, subject to the same authentication and role-based access control (RBAC). This feature is opt-in with `cmf.mcp.enabled`. See [MCP Server for Confluent Manager for Apache Flink](clients-api/mcp.md#cmf-mcp). **Additional Improvements and Fixes** - Added downloadable `.tar.gz` component packages for building custom Docker images for Flink, CMF, and the Kubernetes Operator, as an alternative to the prebuilt images. - Added support for running CMF on the IBM Semeru Runtime. - Added dynamic namespace scoping: namespace watching is now dynamically derived from environments, removing the need to configure `cmf.k8s.watchNamespaces` at runtime. This unblocks multi-cluster in namespace-scoped mode. See [Restrict CMF to specific namespaces](installation/helm.md#cmf-namespace-scoped-rbac). - Added DB2 as a supported metadata storage backend. - Added connection pooling for PostgreSQL, SQL Server, and DB2, with configurable pool settings using `cmf.database.jdbc.pool.*`. - Added Helm chart schema validation to catch configuration errors at install time. - Added support for sidecar and init containers in the CMF Helm chart. - Added support for skipping ServiceAccount, Role, and RoleBinding creation for pre-provisioned environments (`manageEnvironmentRbac` Helm flag). - Stack trace logging is now enabled by default (`cmf.stackTraceLogging: true`). Existing deployments that pin this value to `false` keep their setting on upgrade; remove the explicit setting from your Helm values file to adopt the new default. - Improved compute pool configuration validation: invalid `podTemplate` fields are now rejected rather than silently dropped. - Fixed a missing permission check when binding an environment to a cluster. **CVE fixes** This release includes the following vulnerability fixes for CMF: - CVE-2026-54512, CVE-2026-54513 – jackson-databind vulnerabilities, fixed by upgrading Spring Boot to 3.5.15. - CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515 – Apache Tomcat vulnerabilities, fixed by upgrading to 10.1.55. - CVE-2026-41417, CVE-2026-42578, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-47244, CVE-2026-44249, CVE-2026-45416, CVE-2026-45536 – Netty vulnerabilities, fixed by upgrading to 4.2.15.Final. - CVE-2026-40972, CVE-2026-40973 – Spring Boot vulnerabilities, fixed by upgrading to 3.5.14. - CVE-2026-22745, CVE-2026-22741 – Spring Framework vulnerabilities, fixed by upgrading to 6.2.18. - CVE-2026-45292 – OpenTelemetry vulnerability, fixed by upgrading to 1.62.0. - CVE-2026-35554 – Apache Kafka client vulnerability, fixed by upgrading the Flink-Kafka connector. ### CMF patch releases The following CMF versions are now available with vulnerability fixes: - 2.3.2 - 2.2.2 - 2.1.4 - 2.0.4 ### Confluent Platform for Apache Flink Kubernetes Operator 1.15.0-cp2 This release introduces Confluent Platform for Apache Flink Kubernetes Operator version 1.15.0-cp2, based on the upstream Apache Flink Kubernetes Operator 1.15. ### Confluent Platform for Apache Flink Kubernetes Operator patch releases The following Confluent Platform for Apache Flink Kubernetes Operator versions are now available with vulnerability fixes: - 1.14.0-cp3 - 1.13.0-cp4 - 1.12.1-cp2 ### Flink SQL Docker Image 1.19-cp9 - Added environment catalog support for user-defined functions and custom connectors/formats. See [Manage Environment Catalogs in Confluent Manager for Apache Flink](configure/environment-catalog.md#cmf-environment-catalog). ### Confluent Platform for Apache Flink and Flink SQL The following Confluent Platform for Apache Flink versions are now available with bug and vulnerability fixes: - 2.1.3-cp1 - 2.0.2-cp2 - 1.20.5-cp1 - 1.19.3-cp5 - 1.18.1-cp8 ### Flink Connector Kafka The following Flink Connector Kafka versions are now available with vulnerability fixes: - 4.0.1-2.0-cp3 - 3.4.0-1.20-cp3 - 3.3.0-1.19-cp4 - 3.2.0-1.18-cp3 ## May 2026 This release includes patch releases for Confluent Manager for Apache Flink (CMF), Confluent Platform for Apache Flink, and the Flink SQL Docker image. ### Version 2.3.1 This release introduces CMF version 2.3.1, which provides the following fixes: **CVE fixes** This release includes the following vulnerability fixes for CMF: - CVE-2026-22016 — Oracle Java SE JAXP unauthorized access to critical data via the network. - CVE-2026-34282 — Oracle Java SE networking denial-of-service via the network. - CVE-2026-34481 — Apache Log4j vulnerability, fixed by upgrading to 2.25.4. - CVE-2026-34483, CVE-2026-34487, CVE-2026-34500 — Apache Tomcat vulnerabilities, fixed by upgrading to 10.1.54. - CVE-2026-22735, CVE-2026-22737 — Spring Framework vulnerabilities, fixed by upgrading to 6.2.17. **Additional fixes** - Added `OAUTHBEARER` support for Schema Registry catalog authentication, with automatic token refresh via the bundled Schema Registry client. - Fixed cluster status reconciliation on CMF startup when kubeconfig files are missing. - Fixed an issue where CMF migration could create new application instances even when the application spec was unchanged. - RBAC-filtered environment names in `ERROR_IN_USE` conflict messages so users only see environments they have access to. - Improved field-level label and annotation semantics on `KubernetesCluster` updates. - Added `requestId` to the log pattern for request tracing. - Stopped logging a sensitive exception. ### Confluent Platform for Apache Flink and Flink SQL The following Confluent Platform for Apache Flink versions are now available with bug and vulnerability fixes: - 2.1.2-cp1 - 2.0.2-cp1 - 1.20.4-cp1 - 1.19.3-cp4 - 1.19-cp8 - 1.18.1-cp7 ## April 2026 ### Version 2.3.0 This release introduces Confluent Manager for Apache Flink® (CMF) version 2.3.0, which provides the following new features and fixes: **Major New Features** - **Multi-Kubernetes cluster support:** CMF can now manage Flink workloads across multiple Kubernetes clusters in multiple data centers, regions, cloud vendors, and still benefit from a central control plane for lifecycle management and monitoring. This feature is available for all resources inside an environment, e.g. applications, compute pools and statements. For details on registering, monitoring, and decommissioning clusters, see [Manage Multiple Kubernetes Clusters in Confluent Manager for Apache Flink](configure/kubernetes-clusters.md#cmf-kubernetes-clusters). - **Flink SQL General Availability:** Flink SQL features are generally available (GA) and production-ready in this version of Confluent Platform for Apache Flink. - **Shared compute pools (session clusters):** A new `SHARED` compute pool type runs a single Flink session cluster that serves multiple SQL statements. SQL Statements typically start much faster on a shared compute pool, allowing for a much more interactive experience. In some scenarios, such as many low throughput queries, a shared compute pool also allows for better resource utilization, because multiple SQL statements can share the same Flink cluster resources. - **CREATE TABLE and DROP TABLE DDL support:** Users can now create and drop Kafka-backed tables using Flink SQL. `CREATE TABLE` provisions a Kafka topic and registers schemas in Schema Registry. `DROP TABLE` tears down the Kafka topic, Schema Registry subjects, and persisted metadata. - **Extended ALTER TABLE support for connector properties and changelog modes:** `ALTER TABLE` now supports changing connector properties and two new changelog modes (upsert and retract), building on the `ALTER TABLE` support added in 2.1.0. - **Upsert table support:** Added support for Kafka upsert tables and updating (non-append-only) results in `SELECT` statements. - **EXECUTE STATEMENT SET support:** Enables multi-statement execution via `STATEMENT SET`, allowing multiple `INSERT` statements to be submitted as a single Statement. - **Red Hat certified operator:** Confluent Platform for Apache Flink (Flink Kubernetes Operator, CMF, and corresponding Flink images) is now available as a Red Hat certified operator through OperatorHub. CMF 2.2.0 is also available on Red Hat OperatorHub. - **Scalable resource management through server-side API operations:** CMF list APIs now support server-side filtering, field selection, and search to efficiently handle large numbers of resources. **Additional Improvements and Fixes** - Added `extraEnv` support to the Helm chart, allowing users to inject Kubernetes Secrets and other environment variable sources into the CMF container. Injected values can be referenced as `${ENV_VAR}` placeholders in CMF configuration. See [Inject secrets with environment variables](installation/helm.md#cmf-helm-extra-env). - Flink Kubernetes Operator version validation at CMF startup - Auto-cleanup of `INSERT` statement pods on statement completion. - Deprecated the `cmf.sql.production` configuration flag in favor of the more explicit `encryption.enabled` property. - Renamed the `alterEnvironments` field to `ddlEnvironments` in the KafkaDatabase REST API for clarity. - Fixed an issue where a misconfigured catalog blocked SQL statement submissions from all environments. - Fixed RBAC authorization errors being swallowed and returned as 200 OK with empty results. - Fixed suspend/resume polluting FlinkApplication spec with null fields. - Fixed merging of environment compute pool defaults with the compute pool specification, where user-defined volumes and environment variables were overwritten. - Fixed status field not being updated for upgrade savepoints. - Fixed statements created with `stopped=true` not showing STOPPED phase. - Fixed savepoint path set to string `"null"` when not specified. - Fixed result fetching failure when `lastCheckpointedOffset` is -1 for bounded jobs. - Fixed application event type mismatch on PostgreSQL. - Fixed a regression where statements on deleted compute pools could not be viewed. - Improved error message when restoring a statement from a savepoint (returns 400 instead of 500). - Fixed overwriting existing CMF environment secrets on environment creation. ### Confluent Platform for Apache Flink Kubernetes Operator 1.14.0-cp1 This release introduces Confluent Platform for Apache Flink Kubernetes Operator version 1.14.0-cp1, based on the upstream Apache Flink Kubernetes Operator 1.14. ### Confluent Platform for Apache Flink and Flink SQL The following Confluent Platform for Apache Flink versions are now available with bug and vulnerability fixes: - 2.1.1-cp2 - 2.0.1-cp2 - 1.20.3-cp2 - 1.19.3-cp3 - 1.19-cp7 - 1.18.1-cp6 ## December 2025 This month includes minor and patch releases for Confluent Platform for Apache Flink, Confluent Manager for Apache Flink, Confluent Platform for Apache Flink Kubernetes Operator, and the Flink SQL Docker image. ### Version 2.2.0 This release introduces Confluent Manager for Apache Flink® version 2.2.0, which provides the following new features and fixes: **New Features** - Added support for running CMF on Linux s390x architecture. - Added support for Microsoft SQL Server as an external database for CMF. - Added support for filtering the Statement list by name. - Added a new field in Catalog and Database responses to denote which Environments can access them. - Improved error messages for Statement failures due to Catalog errors. - Made Statement filtering based on phase to be case-insensitive. - Added a REST API to retrieve CMF system information. - Added a REST API to retrieve CMF resource-usage information, and changed the Environment, Compute Pool, Application, and Statement APIs to conditionally include resource-usage information. **CVE Fixes** - CVE-2025-59250 - JDBC Driver for SQL Server has improper input validation issue. - CVE-2025-66566 - yawkat LZ4 Java has a possible information leak in Java safe decompressor. **Additional Fixes** - Fixed an issue where CMF was not starting up intermittently when authorization was enabled. - Fixed an issue with merging an Environment’s Compute Pool defaults with the Compute Pool specification. - Fixed an issue where Savepoint creation failed when the path was not specified. ### Confluent Platform for Apache Flink Operator 1.13.0-cp2 **New Features** - Added support for running the Kubernetes Operator on Linux s390x architecture. **CVE Fixes** - CVE-2025-48924 - Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs. ### Confluent Platform for Apache Flink and Flink SQL The following Confluent Platform for Apache Flink versions are now available: - 2.1.1-cp1 - 2.0.1-cp1 - 1.20.3-cp1 - 1.19.3-cp2 - 1.18.1-cp5 - 1.19-cp5 All of these releases add support for running Confluent Platform for Apache Flink on the s390x architecture. ### Version 2.1.2 This release introduces CMF version 2.1.2, which provides the following fixes: - Fixed various issues with Postgres startup. - Fixed an issue where fetched Databases were not filtered by the Catalog name. ## November 2025 This release includes minor/patch releases for CMF, Flink Connector Kafka, and the Flink SQL Docker image. ### Version 2.1.1 This release introduces new CMF version: 2.1.1, which provides the following fixes: **CVE Fixes** This release includes the following vulnerability fixes for CMF: - CVE-2025-55754 Apache Tomcat - Console manipulation via escape sequences in log messages **Additional Fixes** - Fixed an issue where the loading of configuration `cmf.kafka.oauthbearerAllowedUrls` was not deterministic, which could lead to failures when Authorization is enabled. - Fixed an issue where the values provided for fields `formatType` and `backoffLimit` were incorrectly propagated for `DetachedSavepoint`. - Minor improvements and fixes. ### Flink Connector Kafka Patch Release: Flink Connector Kafka 3.3.0-1.19-cp2 - Fixed the issue of the following missing maven packages: - `com.fasterxml.jackson.core:jackson-annotations` - `com.fasterxml.jackson.core:jackson-databind` ### Flink SQL Docker Image 1.19.4-cp1 - Updated the Flink Connector Kafka to version 3.3.0-1.19-cp2 ## October 2025 ### Version 2.1.0 Major Release: This release introduces CMF version 2.1.0, which provides the following new features and improvements: **New Features** - Added support for Savepoint Management via CMF REST API. - Added support for PostgreSQL as an external database for CMF. - Added support for ALTER TABLE operations in Flink SQL jobs managed by CMF. - Added support for CP_FOR_CC license type. - Added support for auto termination of completed SELECT Flink Statements. - Added support for auto termination of SELECT Flink Statements that haven’t been fetched within a configurable period. - Added support for specifying CPU resources as fractions. - Added support for Flink 2.0 and Flink 2.1. - Added support for renaming Catalogs. - Added support to configure if logging full stack traces. **CVE Fixes** This release includes the following vulnerability fixes for Confluent Manager for Apache Flink: - CVE-2025-58057 Netty’s decoders vulnerable to DoS via zip bomb style attack - CVE-2025-58056 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions - CVE-2025-41249 Spring Framework annotation detection mechanism may result in improper authorization - CVE-2025-55163 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability - CVE-2025-48734 Apache Commons Improper Access Control vulnerability - CVE-2025-48924 Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs - CVE‐2025‐8885 Possible DOS in processing specially formed ASN.1 Object Identifiers - CVE-2025-8916 Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation ### Confluent Platform for Apache Flink Kubernetes Operator 1.13 Major Release: Kubernetes Operator 1.13 ### Flink Connector Kafka Major Release: Flink Connector Kafka 4.0.1-2.0-cp1/ ## July 2025 This release introduces new Apache Flink packages: - Flink 1.20.2-cp1 - Flink 1.19.3-cp1 ## June 2025 This release introduces new Apache Flink packages based on the RHEL UBI 9 image: - Flink 1.20.1-cp3 - Flink 1.19.2-cp3 - Flink 1.18.1-cp4 ## April 2025 This release includes the following vulnerability fixes for Flink: **Flink 1.20.1-cp2** | CVE | CVSS | Upgraded Package | |----------------|--------|-------------------------------------| | CVE-2025-30065 | 10 | org.apache.parquet:parquet\*:1.15.1 | **Flink 1.19.2-cp2** | CVE | CVSS | Upgraded Package | |----------------|--------|-------------------------------------| | CVE-2025-30065 | 10 | org.apache.parquet:parquet\*:1.15.1 | **Flink 1.18.1-cp3** | CVE | CVSS | Upgraded Package | |----------------|--------|-------------------------------------| | CVE-2025-30065 | 10 | org.apache.parquet:parquet\*:1.15.1 | ## March 2025 Confluent Platform 7.9 release adds support for OAuth authentication for CMF REST APIs. #### NOTE OAuth is available starting with Confluent Platform version 7.9, but only with REST APIs. It is NOT available with the Confluent CLI or the Confluent for Kubernetes operator. The new Flink patch versions are now officially available. **Flink 1.20.1-cp1** **Flink 1.19.2-cp1** ## February 2025 - 1.0.3 Confluent Manager for Apache Flink® version 1.0.3 is now available with Confluent Platform 7.8 as a regular maintenance release addressing a number of small issues and updating dependencies. This release does not include new features. ### Fixed issues The following issues were fixed in this release. - Improved validation and error messages of FlinkApplication payloads on the REST API - Removed unneeded Netty 3.10.6 dependency with vulnerabilities ## February 2025 - 1.0.2 Confluent Manager for Apache Flink® version 1.0.2 is now available with Confluent Platform 7.8 as a regular maintenance release addressing a number of small issues and updating dependencies. This release does not include new features. ### Fixed issues The following issues were fixed in this release. - The Helm chart included a default `imagePullSecretRef`, which is not set anymore by default. - YAML payloads were not properly supported by CMF. This release includes the following vulnerability fixes for CMF. **Confluent Manager for Apache Flink® 1.0.2** * Updated Spring Boot to version 3.3.8. | CVE | CVSS | Upgraded Package | |----------------|--------|-------------------------------------| | CVE-2024-52046 | | Upgraded org.apache.mina:mina-core. | ## December 2024 Confluent Platform 7.8 release introduces CMF version 1.0.1 and adds support for Confluent Platform for Apache Flink version 1.20. This release moves Confluent Platform for Apache Flink from limited availability to general availability. Flink versions 1.18 and 1.19 continue to be supported. This release also includes the following vulnerability fixes for Flink: **Flink 1.19.1-cp2** | CVE | CVSS | Upgraded Package | |----------------|--------|------------------------------------------| | CVE-2021-21409 | 5.9 | org.wildfly.openssl==1.0.10.Final | | CVE-2019-14887 | 9.1 | org.apache.pekko:pekko-actor_2.12==1.1.2 | **Flink 1.18.1-cp2** | CVE | CVSS | Upgraded Package | |----------------|--------|------------------------------------------| | CVE-2021-21409 | 5.9 | org.wildfly.openssl==1.0.10.Final | | CVE-2019-14887 | 9.1 | org.apache.pekko:pekko-actor_2.12==1.1.2 | ## July 2024 Confluent Platform 7.7 release introduces Confluent Platform for Apache Flink in limited availability with support for Flink versions 1.18 and 1.19.