Live › vulnerability › CVE-2023-25696
Go to dashboardThe Apache Airflow Hive provider does not validate some input properly, tracked as CVE-2023-25696 and rated critical (CVSS 9.8). The sources do not describe what an attacker can do beyond that rating.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:11 UTC, 0h before NVD. All times on this page are UTC.
Deployments of Apache Airflow that have the Hive provider package installed at a version before 5.1.3. The sources do not say which Hive provider features or input paths are exposed, so the exact trigger is unknown. Teams that do not install this provider can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow-providers-apache-hive | pypi | < 5.1.3 | 5.1.3 |
| apache apache-airflow-providers-apache-hive | vendor | < 5.1.3 | 5.1.3 |
pip show apache-airflow-providers-apache-hive and check the Version line; anything below 5.1.3 is affected.pip freeze | grep apache-airflow-providers-apache-hive in each Airflow environment, including workers and images.5.1.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Input Validation vulnerability in the Apache Airflow Hive Provider.
This issue affects Apache Airflow Hive Provider versions before 5.1.3.
This page as .md · .json · in your agent: get_signal("CVE-2023-25696")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.