ZoomEye finds 167 exposed Apache StreamPark instances

A ZoomEye scan on October 23, 2026 found 167 hosts matching the Apache StreamPark fingerprint and 170 matching its title. An exposed control plane can submit Flink jobs, run arbitrary code on the cluster and expose stored credentials.

• 167 hosts by fingerprint and 170 by title, a gap under 2%
• StreamPark stores JobManager address, Kafka credentials and storage keys
• Submitting a Flink job lets an attacker run code on the cluster
• Recommend VPN-only access and comparing job lists against a baseline