Skip to content
fr Sign in
Not rated

CVE-2026-35194 Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated…

Description

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions. Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Affected products and versions

Product Affected versions Fixed in
Apache Flink 1.15 1.15.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Flink

The 3 CVEs of Apache Flink →
CVE-2020-17519 Apache Flink Improper Access Control Vulnerability 9.1 Critical CVE-2020-17518 Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the… Not rated
Track this CVE