{
  "port": 6123,
  "protocol": "tcp",
  "service": "Apache Flink JobManager RPC (IANA: Backup Express)",
  "oneLiner": "Apache Flink's JobManager RPC port — registered to Backup Express, but Flink is what you find.",
  "whatItIs": "IANA assigns 6123 to backup-express, Catalogic Software's Backup Express. In practice the occupant today is Apache Flink: jobmanager.rpc.port defaults to 6123, and TaskManagers connect to the JobManager on it, so every standalone, YARN, and Kubernetes Flink deployment exposes it internally. It is an RPC channel, not a web UI — Flink's dashboard is 8081. Seeing 6123 on a scan almost always means a stream-processing cluster.",
  "exposure": {
    "verdict": "never",
    "note": "Flink ships with no authentication on its RPC endpoints, and submitting a job is arbitrary code execution on the cluster; keep 6123 inside the cluster network."
  },
  "checkCommand": "nc -vz TARGET 6123",
  "links": [
    {
      "title": "Apache Flink — Configuration (jobmanager.rpc.port)",
      "url": "https://nightlies.apache.org/flink/flink-docs-stable/docs/deployment/config/",
      "kind": "official-docs"
    },
    {
      "title": "apache/flink on GitHub",
      "url": "https://github.com/apache/flink",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6123 (backup-express)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6123",
      "kind": "iana"
    }
  ]
}