CVE-2026-35194 Details
Description
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions. Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.
A code injection vulnerability has been identified in the SQL code generation process of Apache Flink. This issue is present in versions 1.15.0 prior to 1.20.4, as well as in the 2.0.0 through 2.x range. The vulnerability allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers by crafting malicious SQL queries. It specifically affects JSON functions in Flink versions 1.15.0 and above, and LIKE expressions with ESCAPE clauses in versions 1.17.0 and above. The root cause lies in user-controlled strings being improperly escaped before being interpolated into generated Java code, enabling attackers to break out of string literals and inject arbitrary expressions.
Users are advised to upgrade to Apache Flink versions 1.20.4, 2.0.2, 2.1.2, or 2.2.1, all of which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/15/20 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9x | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache flink | >= 1.15.0, < 1.20.4 >= 2.0.0, < 2.0.2 >= 2.1.0, < 2.1.2 2.2.0 - 2.2.0 rc1 2.2.0 rc2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | CVE Modified | CVE |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |