Critical Apache Flink RCE Vulnerability CVE-2023-49272 Patched

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-35194, has been identified in Apache Flink.
• The flaw, a SQL injection, affects distributed data processing environments by allowing authenticated users to execute arbitrary code.
• Specific Flink versions are vulnerable, including those from 1.15.0 through 1.20.x and 2.0.0 through 2.x.
• Patches are available, and immediate upgrades to fixed versions are strongly recommended.

Critical RCE Flaw Discovered in Apache Flink

A severe remote code execution (RCE) vulnerability, designated CVE-2026-35194, has been uncovered in Apache Flink, a widely used open-source framework for distributed stream and batch data processing. This critical flaw could enable attackers to compromise Flink clusters through SQL injection, impacting environments where data processing is a core function.

The vulnerability originates within Flink’s SQL code-generation mechanism. It arises from insufficient sanitization of user-provided input before its integration into dynamically generated Java code. This oversight creates an avenue for authenticated users possessing query submission rights to inject malicious payloads, effectively bypassing intended string boundaries and executing arbitrary code on affected systems.

Affected Flink Components and Versions

The RCE vulnerability specifically targets two components introduced in recent Flink versions:

• JSON functions, first implemented in Flink version 1.15.0.
• LIKE expressions featuring ESCAPE clauses, introduced with version 1.17.0.

Exploiting these features, attackers can construct specially crafted SQL queries designed to manipulate Flink’s code generation process. The ultimate objective is to achieve arbitrary code execution on TaskManager nodes within the Flink cluster, potentially leading to full system compromise.

According to the official advisory, the following Apache Flink versions are susceptible to this critical vulnerability:

• Apache Flink versions 1.15.0 up to, but not including, 1.20.4.
• Apache Flink versions 2.0.0 up to, but not including, 2.0.2, 2.1.2, and 2.2.1.

Apache contributor Martijn Visser publicly disclosed the issue on May 15, 2026. Visser assigned a critical severity rating, underscoring the potential impact on production clusters.

Technical Deep Dive into the Vulnerability

The core of CVE-2026-35194 lies in the unsafe string interpolation practices employed during the translation of SQL queries into Java code. User-controlled input is directly embedded into the generated code without adequate escaping or validation. This critical flaw permits malicious actors to:

• Break out of literal string boundaries within the generated Java code.
• Inject arbitrary Java expressions or method calls.
• Execute malicious code across the distributed TaskManager nodes that form the Flink cluster.

Given Apache Flink’s distributed architecture, successful exploitation of this vulnerability could lead to a complete compromise of the cluster, unauthorized data manipulation, or lateral movement within the compromised environment. The threat is particularly pronounced in multi-tenant or shared environments where users are granted permissions to execute queries. Even without elevated administrative privileges, an attacker could escalate their capabilities and gain control over the backend processing nodes.

Apache has promptly released patched versions to mitigate this critical vulnerability and strongly advises users to upgrade without delay. The recommended secure versions are 1.20.4, 2.0.2, 2.1.2, or 2.2.1.

What You Should Do

• Upgrade Immediately: Prioritize upgrading Apache Flink installations to the patched versions: 1.20.4, 2.0.2, 2.1.2, or 2.2.1.
• Restrict Privileges: Limit SQL query submission capabilities exclusively to trusted users and roles within your organization.
• Monitor Activity: Implement robust monitoring for SQL query activity within Flink clusters to detect and respond to anomalous or suspicious patterns.
• Implement Runtime Controls: Apply additional runtime security controls on TaskManager nodes to enhance protection against potential exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.