Live › vulnerability › CVE-2023-25693
Go to dashboardThe Apache Airflow Sqoop provider package fails to validate input properly before passing it on. The sources do not say exactly what an attacker can inject, but the critical CVSS score points to code execution on the Airflow worker.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:11 UTC, 0h before NVD. All times on this page are UTC.
Teams that run Apache Airflow with the Sqoop provider installed at a version before 3.1.1. The sources do not describe which DAG inputs reach the vulnerable code, so whether a given deployment is reachable is unknown. Teams without the Sqoop provider installed are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow-providers-apache-sqoop | pypi | < 3.1.1 | 3.1.1 |
| apache apache-airflow-providers-apache-sqoop | vendor | < 3.1.1 | 3.1.1 |
pip show apache-airflow-providers-apache-sqoop and check whether the version is below 3.1.1pip list | grep sqoopapache-airflow-providers-apache-sqoop to 3.1.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.
This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2023-25693")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.