CVE-2026-35194

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions. Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9x	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/15/20	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:flink::::::::
	cpe:2.3:a:apache:flink::::::::
	cpe:2.3:a:apache:flink::::::::
	cpe:2.3:a:apache:flink:2.2.0:-::::::
	cpe:2.3:a:apache:flink:2.2.0:rc1::::::
	cpe:2.3:a:apache:flink:2.2.0:rc2::::::

History

No history.

Information

Published : 2026-05-15 16:16

Updated : 2026-06-17 10:40

NVD link : CVE-2026-35194

Mitre link : CVE-2026-35194

CVE.ORG link : CVE-2026-35194

JSON object : View

Products Affected

apache

flink

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-35194", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35194", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T18:27:22.779317Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Flink", "versions": [{"status": "affected", "version": "1.15.0", "lessThan": "1.20.4,2.0.2,2.1.2,2.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-15T16:16:14.340", "references": [{"url": "https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9x", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/15/20", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.\n\nUsers are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue."}], "lastModified": "2026-06-17T10:40:11.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1913CE8-6249-4A07-A8C4-6DC992CB43F3", "versionEndExcluding": "1.20.4", "versionStartIncluding": "1.15.0"}, {"criteria": "cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE1A86BF-0BCE-4731-8600-A460BFBE085F", "versionEndExcluding": "2.0.2", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD6E7A3C-71C6-4209-8EC3-E800F60BAA5D", "versionEndExcluding": "2.1.2", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:apache:flink:2.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B77D4A2-805C-4E37-9C9F-3B977F4C1857"}, {"criteria": "cpe:2.3:a:apache:flink:2.2.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "883F1C45-C050-4D9A-BA6D-1787CC67C4B2"}, {"criteria": "cpe:2.3:a:apache:flink:2.2.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3C268E9-29B9-4FF9-8008-FF942C9C8DDA"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}