Flink vulnerabilities

2 known vulnerabilities in Flink from Apache. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Apache Flink: Improper Control of Generation of Code

  CVE-2026-35194May 15, 2026Apache

  Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affec

• 7.5 High severity

  Apache Flink Improper Access Control Exploited

  CVE-2020-17519Jan 5, 2021ApacheEPSS 98%

  A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by