Every CVE Search/ Get API key

CVE-2026-35194

Apache Flink: Remote code execution via SQL injection in code generation

8.1 HighPublic exploitFix available

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.38%Up 0.3 points since May 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

Apache Flink: Remote code execution via SQL injection in code generation

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Record
CVE-2026-35194
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2026-30550 8.1

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Record
EUVD-2026-30550
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2f54-v4hm-fx73 8.1

Apache Flink: Remote code execution via SQL injection in code generation

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Record
GHSA-2f54-v4hm-fx73
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-94
Updated
2026-11-02
NVD 8.1

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Record
CVE-2026-35194
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-94
Updated
2026-11-02
OSV 8.1

Apache Flink: Remote code execution via SQL injection in code generation

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Record
CVE-2026-35194
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-2f54-v4hm-fx73 8.1

Apache Flink: Remote code execution via SQL injection in code generation

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Record
GHSA-2f54-v4hm-fx73
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-94
Updated
2026-11-02
OSVBIT-flink-2026-35194 No score

Apache Flink: Remote code execution via SQL injection in code generation

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Record
BIT-flink-2026-35194
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.flink:flink-table-planner_2.12
Maven
 1.15.0 up to 1.20.4
1.20.4
org.apache.flink:flink-table-planner_2.12
Maven
 2.0.0 up to 2.0.2
2.0.2
org.apache.flink:flink-table-planner_2.12
Maven
 2.1.0 up to 2.1.2
2.1.2
org.apache.flink:flink-table-planner_2.12
Maven
 2.2.0 up to 2.2.1
2.2.1
org.apache.flink:flink-table-api-java
Maven
 1.15.0 up to 1.20.4
1.20.4
org.apache.flink:flink-table-api-java
Maven
 2.0.0 up to 2.0.2
2.0.2
org.apache.flink:flink-table-api-java
Maven
 2.1.0 up to 2.1.2
2.1.2
org.apache.flink:flink-table-api-java
Maven
 2.2.0 up to 2.2.1
2.2.1
org.apache.flink:flink-table-runtime
Maven
 1.15.0 up to 1.20.4
1.20.4
org.apache.flink:flink-table-runtime
Maven
 2.0.0 up to 2.0.2
2.0.2
Show 12 moreShow less
Affected packages
PackageAffectedFixed
org.apache.flink:flink-table-runtime
Maven
 2.1.0 up to 2.1.2
2.1.2
org.apache.flink:flink-table-runtime
Maven
 2.2.0 up to 2.2.1
2.2.1
flink
Bitnami
 1.15.0 up to 1.20.4, 2.0.0 up to 2.0.2, 2.1.0 up to 2.1.1, 2.2.0 up to 2.2.1
1.20.42.0.22.1.12.2.1
org.apache.flink:flink-table-planner_2.12
Maven
 1.15.0 up to 1.20.4, plus listed versions
1.15.11.15.21.15.31.15.41.16.0
Show 16 moreShow less
1.16.11.16.21.16.31.17.01.17.11.17.21.18.01.18.11.19.01.19.11.19.21.19.31.20.01.20.11.20.21.20.3
1.20.4
org.apache.flink:flink-table-planner_2.12
Maven
 2.0.0 up to 2.0.2, plus listed versions
2.0-preview12.0.1
2.0.2
org.apache.flink:flink-table-planner_2.12
Maven
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
org.apache.flink:flink-table-api-java
Maven
 1.15.0 up to 1.20.4, plus listed versions
1.15.11.15.21.15.31.15.41.16.0
Show 16 moreShow less
1.16.11.16.21.16.31.17.01.17.11.17.21.18.01.18.11.19.01.19.11.19.21.19.31.20.01.20.11.20.21.20.3
1.20.4
org.apache.flink:flink-table-api-java
Maven
 2.0.0 up to 2.0.2, plus listed versions
2.0-preview12.0.1
2.0.2
org.apache.flink:flink-table-api-java
Maven
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
org.apache.flink:flink-table-runtime
Maven
 1.15.0 up to 1.20.4, plus listed versions
1.15.11.15.21.15.31.15.41.16.0
Show 16 moreShow less
1.16.11.16.21.16.31.17.01.17.11.17.21.18.01.18.11.19.01.19.11.19.21.19.31.20.01.20.11.20.21.20.3
1.20.4
org.apache.flink:flink-table-runtime
Maven
 2.0.0 up to 2.0.2, plus listed versions
2.0-preview12.0.1
2.0.2
org.apache.flink:flink-table-runtime
Maven
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubDexSemon/CVE-2026-351942026-07-02

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-35194 is a high vulnerability (CVSS 8.1) in Apache Flink, published May 15, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in org.apache.flink:flink-table-planner_2.12 1.20.4.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open