---
id: "CVE-2023-25693"
kind: "vulnerability"
aliases: ["CVE-2023-25693", "GHSA-j69x-v4wc-3fpf"]
title: "Apache Airflow Sqoop Provider Improper Input Validation vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.01895
exploited: false
status: "open"
category: "package"
products: [{"name": "apache-airflow-providers-apache-sqoop", "fixed": ["3.1.1"], "affected": "< 3.1.1", "ecosystem": "pypi"}, {"name": "apache apache-airflow-providers-apache-sqoop", "fixed": ["3.1.1"], "affected": "< 3.1.1", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["airflow", "cwe-20", "data-pipelines", "package", "pypi", "python"]
not_affected_if: ["sqoop-provider-not-installed"]
published_at: "2023-02-24T12:15:30+00:00"
first_seen_at: "2026-10-26T21:11:45+00:00"
updated_at: "2026-10-26T21:20:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-j69x-v4wc-3fpf", "first_seen_at": "2026-10-26T21:11:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25693", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# Apache Airflow Sqoop Provider Improper Input Validation vulnerability

The Apache Airflow Sqoop provider package fails to validate input properly before passing it on. The sources do not say exactly what an attacker can inject, but the critical CVSS score points to code execution on the Airflow worker.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:apache-airflow-providers-apache-sqoop affected < 3.1.1 fixed 3.1.1
- vendor:apache apache-airflow-providers-apache-sqoop affected < 3.1.1 fixed 3.1.1

## How to check

- Run `pip show apache-airflow-providers-apache-sqoop` and check whether the version is below `3.1.1`
- Search your environment for installed copies of the package with `pip list | grep sqoop`

## Fix

- Upgrade `apache-airflow-providers-apache-sqoop` to `3.1.1` or later

## Timeline

- 2026-10-26T21:11:45+00:00 ghsa https://github.com/advisories/GHSA-j69x-v4wc-3fpf
- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-25693

## From the sources

Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.

This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_