CVE-2026-35194 Apache Flink: Remote code execution via SQL injection in code generation

What is CVE-2026-35194?

CVE-2026-35194 is a high-severity code injection vulnerability in Apache Flink, published on 15 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

Weakness: CWE-94

Which versions are affected by CVE-2026-35194?

25 open source packages ship an affected version, including org.apache.flink:flink-table-api-java, flink and org.apache.flink:flink-table-planner_2.12. It affects 1 product.

Products include Apache Flink.

How do I fix CVE-2026-35194?

Upgrade org.apache.flink:flink-table-api-java to a fixed version for your release line: 1.20.4, 2.0.2, 2.1.2 or 2.2.1.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-35194 being exploited?

There is no known exploitation of CVE-2026-35194 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Flink

• CVE-2020-17519 Apache Flink Improper Access Control Exploited Critical 9.1
• CVE-2020-17518 Apache Flink directory traversal attack: remote file writing through the REST API High 7.5
• CVE-2020-1960 Command injection in Apache Flink Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-flink-2026-35194, ECHO-fb26-ef43-981b, GHSA-2f54-v4hm-fx73, MINI-35w8-758x-rg8w, MINI-8pgq-2h5r-838m, MINI-gp88-p5fc-h9f3 and 1 more.