Vulnerability Report

CVE-2026-35194

RCE

Title: Apache Flink SQL Code Injection Arbitrary Code Execution

RCE

Proof Of Concept

PoC Available for CVE-2026-35194

CWE Category CWE-94

Published Date May 15, 2026

Modified Date May 18, 2026

Exploit Status Available

Score 8.1 CVSS v

Exploit Probability (EPSS)

0.66%

Vulnerability Summary

CVE-2026-35194: Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions. Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Impacted Vendors

apache 1

Reference Links

https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9x

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity HIGH

8.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns