Critical Apache Flink RCE Lets Authenticated Users Execute Code via SQL Injection

Apache disclosed CVE-2026-35194, a critical remote code execution flaw in Apache Flink that allows authenticated users with query submission privileges to run arbitrary code on TaskManager nodes. The vulnerability is caused by improper escaping of user-controlled input during Flink’s SQL code-generation process, where malicious SQL can be translated into attacker-controlled Java code. Apache said the issue affects Flink 1.15.0 through 1.20.x before 1.20.4, and 2.0.0 through 2.x before 2.0.2, 2.1.2, and 2.2.1.

The flaw impacts JSON functions introduced in 1.15.0 and LIKE expressions with ESCAPE clauses introduced in 1.17.0, creating a serious risk for multi-tenant and shared environments where non-administrative users may be able to escalate access, manipulate data, compromise clusters, and move laterally. Apache credited Yaswant Katakam of Confluent InfoSec for reporting the bug, while public disclosure also highlighted the danger of SQL-to-Java code translation paths in Flink’s engine. Organizations were urged to upgrade immediately to the patched releases.