What is the CVSS score of CVE-2026-35194?

CVE-2026-35194 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-35194?

Within 24 hours: Inventory all Apache Flink deployments and document current versions. Within 7 days: Upgrade to patched versions (1.20.4, 2.0.2, 2.1.2, or 2.2.1 depending on your release line). Implement immediate SQL query restrictions to block user-supplied input until patching is complete. Within 30 days: Conduct audit of SQL query logs for suspicious patterns and validate no code injection attempts occurred.

Apache Flink CVE-2026-35194

Q: Which versions of Apache Flink are affected by CVE-2026-35194?

Apache Flink SQL engine contains a code injection vulnerability (CVSS 8.1) that allows authenticated users to execute arbitrary code on distributed task processing nodes through specially crafted SQL…. A patch is available.

EUVD-2026-30550 HIGH

Code Injection (CWE-94)

2026-05-15 apache

GHSA-2f54-v4hm-fx73

RCE Apache Java Code Injection

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 19:22 vuln.today

CVSS changed

May 15, 2026 - 19:22 NVD

8.1 (HIGH)

Patch available

May 15, 2026 - 17:01 EUVD

CVE Published

May 15, 2026 - 15:27 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

27 maven packages depend on org.apache.flink:flink-table-api-java (8 direct, 19 indirect)
6 maven packages depend on org.apache.flink:flink-table-planner_2.12 (6 direct, 0 indirect)
23 maven packages depend on org.apache.flink:flink-table-runtime (19 direct, 4 indirect)

Ecosystem-wide dependent count for version 1.15.0 and other introduced versions.

DescriptionNVD

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

AnalysisAI

Code injection in Apache Flink's SQL engine allows authenticated users to execute arbitrary code on TaskManagers through malicious SQL queries. The vulnerability affects JSON functions in versions 1.15.0+ and LIKE expressions with ESCAPE clauses in versions 1.17.0+, where user-controlled strings are interpolated into generated Java code without proper escaping. …

RemediationAI

Within 24 hours: Inventory all Apache Flink deployments and document current versions. Within 7 days: Upgrade to patched versions (1.20.4, 2.0.2, 2.1.2, or 2.2.1 depending on your release line). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2025-48977 HIGH This Week

8.5 May 28

Path traversal in Apache Ignite 2.0.0 through 2.17.0 lets authenticated REST API users read arbitrary files on the serve

CVE-2026-42782 HIGH This Week

7.2 May 25

Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig

CVE-2026-43827 MEDIUM This Month

5.9 May 25

Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0

CVE-2026-43828 MEDIUM This Month

5.9 May 25

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue

CVE-2026-44598 MEDIUM This Month

5.1 May 25

With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vu

CVE-2026-35194 vulnerability details – vuln.today

Back