Apache Flink: Remote code execution via SQL injection in code generation
Priority LOW 37CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions. Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00381 32nd percentileScored 2026-11-07
Fix Fixed Apache Flink (Apache Software Foundation): 1.20.4,2.0.2,2.1.2,2.2.1org.apache.flink:flink-table-planner_2.12 (Maven): 1.20.4, 2.0.2, 2.1.2 +1+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Flink | 1.15.0 to before 1.20.4,2.0.2,2.1.2,2.2.1 | 1.20.4,2.0.2,2.1.2,2.2.1 | Patch available | CNA |
| — | org.apache.flink:flink-table-planner_2.12 (Maven) | 1.15.0 to before 1.20.4 | 1.20.4 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-planner_2.12 (Maven) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-planner_2.12 (Maven) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-planner_2.12 (Maven) | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-api-java (Maven) | 1.15.0 to before 1.20.4 | 1.20.4 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-api-java (Maven) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-api-java (Maven) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-api-java (Maven) | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-runtime (Maven) | 1.15.0 to before 1.20.4 | 1.20.4 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-runtime (Maven) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-runtime (Maven) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-2f54-v4hm-fx73 |
| — | org.apache.flink:flink-table-runtime (Maven) | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-2f54-v4hm-fx73 |
- Apache Flink VendorApache Affected 1.15.0 to before 1.20.4,2.0.2,2.1.2,2.2.1 Fixed in 1.20.4,2.0.2,2.1.2,2.2.1 Patch available CNA
- org.apache.flink:flink-table-planner_2.12 (Maven) Vendor— Affected 1.15.0 to before 1.20.4 Fixed in 1.20.4 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-planner_2.12 (Maven) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-planner_2.12 (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-planner_2.12 (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-api-java (Maven) Vendor— Affected 1.15.0 to before 1.20.4 Fixed in 1.20.4 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-api-java (Maven) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-api-java (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-api-java (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-runtime (Maven) Vendor— Affected 1.15.0 to before 1.20.4 Fixed in 1.20.4 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-runtime (Maven) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-runtime (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-2f54-v4hm-fx73
- org.apache.flink:flink-table-runtime (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-2f54-v4hm-fx73
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:* | 1.15.0 to before 1.20.4; 2.0.0 to before 2.0.2; 2.1.0 to before 2.1.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:flink:2.2.0:-:*:*:*:*:*:* | 2.2.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:flink:2.2.0:rc1:*:*:*:*:*:* | 2.2.0 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:flink:2.2.0:rc2:*:*:*:*:*:* | 2.2.0 rc2 | Vulnerable | Apache |
- cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:* Versions 1.15.0 to before 1.20.4; 2.0.0 to before 2.0.2; 2.1.0 to before 2.1.2 Vulnerable ·Apache
- cpe:2.3:a:apache:flink:2.2.0:-:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
- cpe:2.3:a:apache:flink:2.2.0:rc1:*:*:*:*:*:* Versions 2.2.0 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:flink:2.2.0:rc2:*:*:*:*:*:* Versions 2.2.0 rc2 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Flink (Apache Software Foundation) Fixed in 1.20.4,2.0.2,2.1.2,2.2.1
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-planner_2.12 (Maven) Fixed in 1.20.4 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-planner_2.12 (Maven) Fixed in 2.0.2 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-planner_2.12 (Maven) Fixed in 2.1.2 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-planner_2.12 (Maven) Fixed in 2.2.1 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-api-java (Maven) Fixed in 1.20.4 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-api-java (Maven) Fixed in 2.0.2 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-api-java (Maven) Fixed in 2.1.2 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-api-java (Maven) Fixed in 2.2.1 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-runtime (Maven) Fixed in 1.20.4 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-runtime (Maven) Fixed in 2.0.2 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-runtime (Maven) Fixed in 2.1.2 Advisory →
- Fix · GHSA-2f54-v4hm-fx73 org.apache.flink:flink-table-runtime (Maven) Fixed in 2.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-35194
- 2026-10-03 Alias added: GHSA-2f54-v4hm-fx73
- 2026-10-13 EPSS moved to the 50th–90th percentile
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Advisory 3
More Apache Flink vulnerabilities
- TI-2020-13268 Apache Flink directory traversal attack: reading remote files through the REST API KEVCVSS 3.1CRITICAL 9.1
- TI-2020-13267 Apache Flink directory traversal attack: remote file writing through the REST API CVSS 3.1HIGH 7.5
- TI-2020-01884 Injection in Apache Flink CVSS 3.1MEDIUM 4.7
Sources
- CVE-2026-35194 · CVE Program
- CVE-2026-35194 · NVD
- FIRST EPSS
- GHSA-2f54-v4hm-fx73 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences