jobmanager
Flink JobManagerSQL Gateway host
Runs the Flink JobManager and starts the SQL Gateway REST API on port 8083. Exposes ports 8081 (Web UI) and 8083 (SQL Gateway) to the host.
docker-compose.yml:12-38DexSemon/CVE-2026-25194
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Python script that exploits CVE-2026-35194, a SQL code injection vulnerability in Apache Flink, to achieve remote code execution on TaskManagers via the SQL Gateway REST API. It provides two injection vectors (JSON field name and LIKE pattern) to inject arbitrary Java code into generated code.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-35194 targeting Apache Flink SQL Gateway. The Python script (exploit.py) and README.md describe and implement two SQL injection vectors (JSON field name and LIKE pattern) to achieve remote code execution on a vulnerable TaskManager. All code is consistent with the stated exploit purpose: it connects to a user-supplied target, checks the version, creates a session, and injects a user-supplied shell command. No concealed backdoor, unrelated payload, persistence mechanism, or credential exfiltration is present. The exploit behavior is transparent and directed solely at the specified target.
ClassificationExploit
Model confidence100%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a Python script that actively exploits a vulnerability to achieve remote code execution. It constructs and sends malicious payloads to a target service, injects arbitrary Java code, and executes shell commands on the remote host. This is the definition of an exploit.
exploit.py:1-7exploit.py:152-157exploit.py:184-189Requirements
- Network access to the Flink SQL Gateway REST API (default port 8083)
exploit.py:14-15 - Target must be running a vulnerable version of Apache Flink (1.15.0–1.20.3, 2.0.0–2.2.0)
exploit.py:9-10
Observed behavior
- Checks if the target is a vulnerable Flink SQL Gateway by querying /v1/info and parsing the version string.
exploit.py:47-87 - Creates a SQL Gateway session via POST /v1/sessions.
exploit.py:89-104 - Constructs a malicious SQL statement that injects Java code into a generated code string via a crafted JSON field name (JSON vector) or LIKE pattern (LIKE vector).
exploit.py:139-197 - Submits the malicious SQL statement to the gateway, triggering code generation and execution of the injected Java code (Runtime.getRuntime().exec) on the TaskManager.
exploit.py:199-244 - Provides a --check-only mode that only performs version detection without exploitation.
exploit.py:312-316
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- The script accepts a target host, port, and shell command from the user and sends crafted SQL statements to the Flink SQL Gateway REST API to trigger code generation injection.This is the normal, documented behavior of a PoC exploit for the stated CVE.
exploit.py:199-244exploit.py:286-358 - Target Interaction
- The script interacts exclusively with the Flink SQL Gateway REST API endpoints /v1/info, /v1/sessions, /v1/sessions/{handle}/statements, and /v1/sessions/{handle}/operations/{op}/status.No connections to unrelated external hosts or services are made.
exploit.py:50-51exploit.py:92-97exploit.py:108-111exploit.py:119-125
What the analysis did not establish
- Evidence does not include the Docker Compose file or any other files from the repository, so the lab environment setup cannot be verified.
- The CVE record (CVE-2026-25194) was absent from the acquired CVEList, so the vulnerability details could not be corroborated against the official record.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its effectiveness is not confirmed.
- One file (docker-compose.yml) was present in the repository but not included in the text evidence; its content was not reviewed.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubdocker-compose.yml
Created Vuln labCVE-2026-25194Compose · images
Analysis
Environment assessment
A Docker Compose environment deploying a vulnerable Apache Flink 1.20.3 cluster (JobManager + TaskManager) with the SQL Gateway REST API exposed on port 8083, intended for demonstrating CVE-2026-35194 SQL code injection RCE.
docker-compose.yml:1-59README.md:1-97Lab assessment
Vulnerability labThe README explicitly states the lab is for CVE-2026-35194, a code injection vulnerability in Apache Flink, and provides step-by-step exploit instructions. The Docker Compose file deploys the vulnerable version (1.20.3) and exposes the attack surface (SQL Gateway on port 8083). The exploit script targets the same vulnerability.
README.md:1-3docker-compose.yml:3-4exploit.py:1-4Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
taskmanager
Flink TaskManagerRCE target
Runs a Flink TaskManager that connects to the JobManager. The exploit executes arbitrary commands on this container.
docker-compose.yml:40-55README.md:55-57exploit.py
Exploit script
Python script that exploits CVE-2026-35194 via the SQL Gateway REST API using JSON field name or LIKE pattern injection to achieve RCE on the TaskManager.
exploit.py:1-358How the supplied evidence relates each vulnerability
CVE-2026-25194
Insufficient evidence
The unit_cve_ids array contains only CVE-2026-25194, but all evidence files (README, exploit.py, docker-compose.yml) reference CVE-2026-35194. The repository name also uses CVE-2026-25194, creating a conflict. No evidence in the supplied packet supports CVE-2026-25194; the visible behavior targets CVE-2026-35194.
README.md:1exploit.py:3docker-compose.yml:3Requirements and sequence described by the evidence
Prerequisites
- Docker and Docker Compose installed to deploy the lab.
README.md:17-18 - Python 3 and 'requests' library to run the exploit script.
README.md:33-35 - Network access to the SQL Gateway REST API (port 8083) on the target.
README.md:9
Evidence-described exercise path
- Deploy the vulnerable lab using 'docker compose up -d'.
README.md:17-18 - Verify the SQL Gateway is running by querying /v1/info.
README.md:25-28 - Install Python dependencies (pip install requests).
README.md:33-35 - Run the exploit script with a chosen vector (json or like) and command.
README.md:39-47 - Verify RCE by checking the output file on the TaskManager container.
README.md:55-57
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is directed at the lab's own target (the TaskManager container). The exploit script executes commands only within the lab environment. Port mappings (8081, 8083) are necessary for the exercise. No hidden, destructive, or external behavior is observed.
exploit.py:1-358docker-compose.yml:1-59What the analysis did not establish
- CVE identifier mismatch: repository name and unit_cve_ids use CVE-2026-25194, but all evidence files reference CVE-2026-35194. The packet does not resolve this conflict.
- The exploit script is a Python source file; its behavior is fully visible and no binary files are present.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.