PT-2026-41310 · Apache · Apache Flink

CVE-2026-35194 · Published 2026-05-15 · Updated 2026-05-20

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Flink versions 1.15.0 through 1.20.x Apache Flink versions 2.0.0 through 2.x

Description Code injection in SQL code generation allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers using maliciously crafted SQL queries. The issue occurs because user-controlled strings are interpolated into generated Java code without proper escaping, enabling attackers to break out of string literals and inject arbitrary expressions. This affects JSON functions and LIKE expressions with ESCAPE clauses.

Recommendations Upgrade versions 1.15.0 through 1.20.x to 1.20.4. Upgrade versions 2.0.0 through 2.x to 2.0.2, 2.1.2, or 2.2.1.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-FLINK-2026-35194

CVE-2026-35194

GHSA-2F54-V4HM-FX73

Affected Products

Apache Flink

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35194.json · Exploit
• https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9x · Vendor Advisory
• https://osv.dev/vulnerability/BIT-flink-2026-35194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35194 · Security Note
• https://osv.dev/vulnerability/GHSA-2f54-v4hm-fx73 · Vendor Advisory
• https://github.com/apache/flink/commit/8db22cf8fbc4c785f6ffd41c2fd3e8b64a9688cd · Note
• https://github.com/apache/flink/commit/64007b131d689158af90ca1c1b71b018129a85c5 · Note
• https://github.com/apache/flink · Note
• https://t.me/cveNotify/163688 · Telegram Post
• https://twitter.com/cybrsecpath/status/2055975825590345870 · Twitter Post
• https://t.me/cveNotify/163910 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/15/20 · Note
• https://twitter.com/oss_security/status/2056950041613320587 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2056206640349901078 · Twitter Post