{"id":"CVE-2023-25693","kind":"vulnerability","aliases":["CVE-2023-25693","GHSA-j69x-v4wc-3fpf"],"related":[],"title":"Apache Airflow Sqoop Provider Improper Input Validation vulnerability","description":"Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.\n\nThis issue affects Apache Airflow Sqoop Provider versions before 3.1.1.","summary":"The Apache Airflow Sqoop provider package fails to validate input properly before passing it on. The sources do not say exactly what an attacker can inject, but the critical CVSS score points to code execution on the Airflow worker.","severity":"critical","cvss":9.8,"epss":0.01895,"exploited":false,"exploited_at":null,"products":[{"name":"apache-airflow-providers-apache-sqoop","fixed":["3.1.1"],"affected":"< 3.1.1","ecosystem":"pypi"},{"name":"apache apache-airflow-providers-apache-sqoop","fixed":["3.1.1"],"affected":"< 3.1.1","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["airflow","cwe-20","data-pipelines","package","pypi","python"],"not_affected_if":["sqoop-provider-not-installed"],"how_to_check":"- Run `pip show apache-airflow-providers-apache-sqoop` and check whether the version is below `3.1.1`\n- Search your environment for installed copies of the package with `pip list | grep sqoop`","fix":"- Upgrade `apache-airflow-providers-apache-sqoop` to `3.1.1` or later","status":"open","published_at":"2023-02-24T12:15:30+00:00","first_seen_at":"2026-10-26T21:11:45+00:00","triaged_at":"2026-10-26T21:12:40+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T21:12:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `apache-airflow-providers-apache-sqoop` to `3.1.1` or later","reach":"unknown","title":"Airflow Sqoop provider: improper input validation lets attackers run commands","impact":"high","summary":"The Apache Airflow Sqoop provider package fails to validate input properly before passing it on. The sources do not say exactly what an attacker can inject, but the critical CVSS score points to code execution on the Airflow worker.","category":"package","nicknames":[],"who_cares":["airflow","python","data-pipelines","pypi"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker may run commands on the Airflow worker host","analyst_note":"Confirm the attack vector and required privileges from the GHSA-j69x-v4wc-3fpf advisory, since the sources only give the CWE-20 label and a short description.","how_to_check":"- Run `pip show apache-airflow-providers-apache-sqoop` and check whether the version is below `3.1.1`\n- Search your environment for installed copies of the package with `pip list | grep sqoop`","needs_analyst":true,"not_affected_if":["sqoop-provider-not-installed"],"who_is_affected":"Teams that run Apache Airflow with the Sqoop provider installed at a version before 3.1.1. The sources do not describe which DAG inputs reach the vulnerable code, so whether a given deployment is reachable is unknown. Teams without the Sqoop provider installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000614,"input_tokens":3340,"output_tokens":560,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-20':35B '-2023':10A,18A '-25693':11A,19A '3.1.1':100C '3fpf':16A 'affect':93C 'airflow':2A,22A,29A,33B,44B,79B,88C,95C 'apach':1A,43B,87C,94C 'apache':21A,24A,26A,28A,31A 'apache-airflow-providers-apache-sqoop':20A,27A 'attack':65B 'code':75B 'critic':70B 'cve':9A,17A 'cvss':71B 'cwe':34B 'data':37B 'data-pipelin':36B 'exact':62B 'execut':76B 'fail':48B 'ghsa':13A 'ghsa-j69x-v4wc-3fpf':12A 'improp':5A,81C 'inject':67B 'input':6A,51B,82C 'issu':92C 'j69x':14A 'packag':39B,47B 'pass':54B 'pipelin':38B 'point':73B 'proper':52B 'provid':4A,46B,90C,97C 'providers':23A,30A 'pypi':40B 'python':41B 'say':61B 'score':72B 'sourc':58B 'sqoop':3A,25A,32A,45B,89C,96C 'v4wc':15A 'valid':7A,50B,83C 'version':98C 'vulner':8A,84C 'worker':80B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Apache Airflow with the Sqoop provider installed at a version before 3.1.1. The sources do not describe which DAG inputs reach the vulnerable code, so whether a given deployment is reachable is unknown. Teams without the Sqoop provider installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-02-24T12:15:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-j69x-v4wc-3fpf","url":"https://github.com/advisories/GHSA-j69x-v4wc-3fpf","severity":"critical","published_at":"2023-02-24T12:31:20+00:00","modified_at":"2026-10-26T21:10:13+00:00","first_seen_at":"2026-10-26T21:11:45+00:00","fetched_at":"2026-10-26T21:11:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-25693","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25693","severity":null,"published_at":"2023-02-24T12:15:30+00:00","modified_at":"2026-06-17T05:41:45+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}