{"id":"CVE-2023-25696","kind":"vulnerability","aliases":["CVE-2023-25696","GHSA-9mwf-mw74-9cv5"],"related":[],"title":"Apache Airflow Hive Provider Improper Input Validation vulnerability","description":"Improper Input Validation vulnerability in the Apache Airflow Hive Provider.\n\nThis issue affects Apache Airflow Hive Provider versions before 5.1.3.","summary":"The Apache Airflow Hive provider does not validate some input properly, tracked as CVE-2023-25696 and rated critical (CVSS 9.8). The sources do not describe what an attacker can do beyond that rating.","severity":"critical","cvss":9.8,"epss":0.01982,"exploited":false,"exploited_at":null,"products":[{"name":"apache-airflow-providers-apache-hive","fixed":["5.1.3"],"affected":"< 5.1.3","ecosystem":"pypi"},{"name":"apache apache-airflow-providers-apache-hive","fixed":["5.1.3"],"affected":"< 5.1.3","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["apache-airflow","cwe-20","hive","package","python"],"not_affected_if":["hive-provider-not-installed","version-5.1.3-or-later"],"how_to_check":"- Run `pip show apache-airflow-providers-apache-hive` and check the Version line; anything below `5.1.3` is affected.\n- Run `pip freeze | grep apache-airflow-providers-apache-hive` in each Airflow environment, including workers and images.","fix":"- Upgrade apache-airflow-providers-apache-hive to `5.1.3` or later.\n- Rebuild Airflow images and workers so the fixed version is in every environment.","status":"open","published_at":"2023-02-24T12:15:30+00:00","first_seen_at":"2026-10-26T21:11:45+00:00","triaged_at":"2026-10-26T21:12:45+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T21:12:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade apache-airflow-providers-apache-hive to `5.1.3` or later.\n- Rebuild Airflow images and workers so the fixed version is in every environment.","reach":"unknown","title":"Apache Airflow Hive provider: improper input validation flaw, fixed in 5.1.3","impact":"high","summary":"The Apache Airflow Hive provider does not validate some input properly, tracked as CVE-2023-25696 and rated critical (CVSS 9.8). The sources do not describe what an attacker can do beyond that rating.","category":"package","nicknames":[],"who_cares":["apache-airflow","hive","python"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sources give a critical 9.8 score; attacker effect not described.","analyst_note":"Read the GHSA advisory at https://github.com/advisories/GHSA-9mwf-mw74-9cv5 to confirm the attack vector, required privileges and the input path affected.","how_to_check":"- Run `pip show apache-airflow-providers-apache-hive` and check the Version line; anything below `5.1.3` is affected.\n- Run `pip freeze | grep apache-airflow-providers-apache-hive` in each Airflow environment, including workers and images.","needs_analyst":true,"not_affected_if":["hive-provider-not-installed","version-5.1.3-or-later"],"who_is_affected":"Deployments of Apache Airflow that have the Hive provider package installed at a version before 5.1.3. The sources do not say which Hive provider features or input paths are exposed, so the exact trigger is unknown. Teams that do not install this provider can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001088,"input_tokens":3332,"output_tokens":1510,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-20':37B '-2023':10A,18A,55B '-25696':11A,19A,56B '5.1.3':94C '9.8':61B '9cv5':16A '9mwf':14A 'affect':87C 'airflow':2A,22A,29A,35B,43B,82C,89C 'apach':1A,34B,42B,81C,88C 'apache':21A,24A,26A,28A,31A 'apache-airflow':33B 'apache-airflow-providers-apache-hive':20A,27A 'attack':69B 'beyond':72B 'critic':59B 'cve':9A,17A,54B 'cvss':60B 'cwe':36B 'describ':66B 'ghsa':13A 'ghsa-9mwf-mw74-9cv5':12A 'hive':3A,25A,32A,38B,44B,83C,90C 'improp':5A,75C 'input':6A,50B,76C 'issu':86C 'mw74':15A 'packag':39B 'proper':51B 'provid':4A,45B,84C,91C 'providers':23A,30A 'python':40B 'rate':58B,74B 'sourc':63B 'track':52B 'valid':7A,48B,77C 'version':92C 'vulner':8A,78C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache Airflow that have the Hive provider package installed at a version before 5.1.3. The sources do not say which Hive provider features or input paths are exposed, so the exact trigger is unknown. Teams that do not install this provider can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-02-24T12:15:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9mwf-mw74-9cv5","url":"https://github.com/advisories/GHSA-9mwf-mw74-9cv5","severity":"critical","published_at":"2023-02-24T12:31:20+00:00","modified_at":"2026-10-26T21:09:56+00:00","first_seen_at":"2026-10-26T21:11:45+00:00","fetched_at":"2026-10-26T21:11:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-25696","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25696","severity":null,"published_at":"2023-02-24T12:15:30+00:00","modified_at":"2026-06-17T05:41:45+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}