Why does Veracode report CWE-89?

Question

I have this SQL query written in JDBC which contains dynamic table and fields names:

    private String checkDimension(String tenantId, String prefix, Long schema