Product · Apache Software Foundation

Apache Flink

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 8.1

CVE-2026-35194 Public exploit

Apache Flink: Remote code execution via SQL injection in code generation

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affe…

Apache Software Foundation Apache Flink org.apache.flink:flink-table-api-java org.apache.flink:flink-table-planner_2.12 Maven

May 15, 2026
High 7.5

CVE-2020-17518 Public exploit EPSS 49%

Apache Flink directory traversal attack: remote file writing through the REST API

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users…

Apache Software Foundation Apache Flink org.apache.flink:flink-runtime Maven

Jan 5, 2021