Possible SQL injection

I was playing with Zeppelin. I found JdbcRealm implementation could result in SQL injection.  I am not sure about the exploitability. Since  an untrusted user need to modify the config.

vulnerable code 

userquery = String.format("SELECT %s FROM %s", username, tablename);