CVE-2025-62228: Apache Flink CDC SQL Injection Vulnerability

CVE-2025-62228 Overview

CVE-2025-62228 is a SQL injection vulnerability [CWE-89] affecting Apache Flink CDC (Change Data Capture) version 3.4.0. The flaw allows an authenticated database user to inject SQL through maliciously crafted identifiers, such as database names or table names, that are not properly sanitized before being incorporated into queries. Exploitation requires high privileges because only a logged-in database user can trigger the attack. The Apache Flink project addressed the issue in Flink CDC version 3.5.0. The vulnerability was published to the National Vulnerability Database on October 9, 2025.

Critical Impact
An authenticated attacker can manipulate SQL statements executed by Flink CDC, potentially altering data flow, exposing information, or affecting integrity of downstream systems.

Affected Products

Apache Flink CDC 3.4.0
Pipelines using Flink CDC connectors with attacker-influenced identifier names
Deployments that have not upgraded to Flink CDC 3.5.0

Discovery Timeline

2025-10-09 - CVE-2025-62228 published to NVD and disclosed via the Apache Security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62228

Vulnerability Analysis

Apache Flink CDC ingests change events from source databases and propagates them into Flink pipelines. Version 3.4.0 builds SQL statements by interpolating identifier values such as database names and table names directly into query strings. When those identifiers contain SQL metacharacters, the parser treats the injected content as additional SQL syntax rather than literal identifier data.

The attacker must already hold valid database credentials to influence the identifier values that Flink CDC reads. Once injected, the crafted SQL executes in the context of the Flink CDC connector against the target database. The CWE-89 classification reflects neutralization failure of special elements used in SQL commands.

Root Cause

The root cause is improper sanitization and escaping of database object identifiers before they are concatenated into SQL statements. Flink CDC 3.4.0 trusted identifier strings supplied through database metadata without applying identifier quoting or validation. The 3.5.0 release introduces handling that prevents identifiers from breaking out of their syntactic position.

Attack Vector

Exploitation occurs over the network through the database connection that Flink CDC monitors. An authenticated user with sufficient permissions creates a database or table whose name contains SQL syntax fragments. When Flink CDC enumerates or processes that object, the crafted identifier becomes part of an executable statement. The vulnerability does not require user interaction beyond normal CDC operations.

No public proof-of-concept has been published for CVE-2025-62228. See the Apache Security Mailing List Post and the OpenWall OSS-Security Update for the vendor advisory text.

Detection Methods for CVE-2025-62228

Indicators of Compromise

Database or table names containing SQL metacharacters such as quotes, semicolons, or comment sequences (--, /*)
Flink CDC connector logs showing parse errors or unexpected statements when enumerating schemas
Creation of database objects by low-trust users immediately before anomalous Flink CDC query activity

Detection Strategies

Audit Flink CDC source database catalogs for identifiers that deviate from expected naming conventions
Enable database query logging on sources monitored by Flink CDC and review statements generated by the CDC user
Correlate CREATE DATABASE and CREATE TABLE events against Flink CDC job logs to identify suspicious sequences

Monitoring Recommendations

Track the installed Flink CDC version across pipelines and alert on any host still running 3.4.0
Monitor for new schema objects created by accounts that should not have DDL privileges on CDC-monitored databases
Forward database and Flink job logs to a centralized analytics platform to enable cross-source correlation of injection attempts

How to Mitigate CVE-2025-62228

Immediate Actions Required

Upgrade Apache Flink CDC to version 3.5.0 or later on all pipelines
Inventory database accounts used by Flink CDC and restrict DDL permissions on monitored sources
Review existing source databases for identifiers that contain SQL metacharacters and rename them

Patch Information

Apache resolved CVE-2025-62228 in Flink CDC 3.5.0. Operators should follow the project's upgrade documentation and validate connector compatibility before deployment. Patch details are available in the Apache Security Mailing List Post.

Workarounds

Limit which database users can create or rename databases and tables observed by Flink CDC
Apply naming policies that reject identifiers containing quotes, semicolons, or comment tokens
Run Flink CDC connectors with a dedicated, least-privileged database role to contain the impact of any injected statement

bash

# Verify the installed Flink CDC version and upgrade if 3.4.0 is detected
flink --version
grep -R "flink-cdc" /opt/flink/lib/ | grep -E "3\.4\.0"
# Replace 3.4.0 artifacts with 3.5.0 or later from the Apache Flink CDC release