Vulnerability Description
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions. Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Flink | >= 1.15.0, < 1.20.4 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9xMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/05/15/20Mailing ListThird Party Advisory
FAQ
What is CVE-2026-35194?
CVE-2026-35194 is a vulnerability with a CVSS score of 8.1 (HIGH). Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers ...
How severe is CVE-2026-35194?
CVE-2026-35194 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35194?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Flink.