Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.flink:flink-table-runtime

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    Apache Flink: Remote code execution via SQL injection in code generation

    CVE-2026-35194 · GHSA-2f54-v4hm-fx73

    Affected
    • Maven org.apache.flink:flink-table-runtime >= 1.15.0, < 1.20.4; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.2; >= 2.2.0, < 2.2.1
    Fixed in
    1.20.42.1.22.0.22.2.1· Vendor fix available
    Issue
    Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions. Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

    Recommended action: Upgrade to 2.2.1, 2.1.2, 2.0.2 or 1.20.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →