Loading story…
Apache disclosed CVE-2026-35194, a critical remote code execution flaw in Apache Flink that allows authenticated users with query submission privileges to run arbitrary code on TaskManager nodes. The vulnerability is caused by improper escaping of user-controlled input during Flink’s SQL code-generation process, where malicious SQL can be translated into attacker-controlled Java code. Apache said the issue affects Flink 1.15.0 through 1.20.x before 1.20.4, and 2.0.0 through 2.x before 2.0.2, 2.1.2, and 2.2.1.
The flaw impacts JSON functions introduced in 1.15.0 and LIKE expressions with ESCAPE clauses introduced in 1.17.0, creating a serious risk for multi-tenant and shared environments where non-administrative users may be able to escalate access, manipulate data, compromise clusters, and move laterally. Apache credited Yaswant Katakam of Confluent InfoSec for reporting the bug, while public disclosure also highlighted the danger of SQL-to-Java code translation paths in Flink’s engine. Organizations were urged to upgrade immediately to the patched releases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Apache released fixed versions 1.20.4, 2.0.2, 2.1.2, and 2.2.1 to address CVE-2026-35194 and advised users to upgrade. The vulnerable ranges were identified as 1.15.0 through 1.20.x and 2.0.0 through 2.x before those releases.
On 2026-05-15, Apache publicly disclosed CVE-2026-35194, a critical remote code execution vulnerability in Flink caused by SQL injection during code generation. The issue was credited to Yaswant Katakam of Confluent InfoSec.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceseclists.org
Open sourcelists.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-56287**, an important-severity vulnerability in **Apache Fineract** that allows an authenticated user to exploit the Client Search API through insufficient validation of the `orderBy` and `sortOrder` parameters in `GET /api/v1/clients`. The flaw affects **Fineract 1.14.0 and earlier affected releases**, while **1.15.0** is listed as unaffected. An attacker must have permission to view clients to trigger the issue. Successful exploitation can enable **blind boolean-based SQL injection** for arbitrary data extraction, and in deployments using **MySQL or MariaDB**, it can also expose local files via the database `LOAD_FILE()` function. Apache Fineract, a platform used for digital financial services, advised users to upgrade to a fixed release to mitigate the risk of database compromise and local file disclosure.
Jul 15, 2026
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026Apache NiFi fixed **CVE-2026-39816**, a high-severity flaw that lets authenticated users execute arbitrary code without the `EXECUTE_CODE` permission when certain optional graph extensions are installed, particularly `nifi-other-graph-services-nar`. The issue affects NiFi versions **2.0.0-M1 through 2.8.0** and stems from the `TinkerpopClientService`, which can compile and run user-supplied **Groovy** code before submitting a graph query. Apache attributed the bug to a missing restricted annotation tied to the Execute Code required permission, creating a privilege-boundary bypass in deployments using TinkerPop graph query features. The vulnerability was reported by **John Walker of ZeroPath** and tracked as `NIFI-15800`, with Apache addressing it in **NiFi 2.9.0**. ZeroPath said the flaw reflects a mismatch in NiFi’s privilege model, where graph query functionality was not treated as a code-execution path even though TinkerPop’s native query mode can trigger server-side code execution; the researchers also published a proof of concept showing shell access on a vulnerable server. Organizations running affected NiFi deployments are advised to upgrade to **2.9.0 or later** or remove the impacted optional graph-related NAR extensions if an upgrade cannot be completed immediately.
Jun 29, 2026