Live › vulnerability › CVE-2023-28706
Go to dashboardThe Apache Airflow Hive provider builds code from input it does not properly control, so crafted input can make it generate and run attacker-chosen code. An attacker who can reach that input path can run code in the Airflow worker or scheduler context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:11 UTC, 0h before NVD. All times on this page are UTC.
Teams running Apache Airflow with the Hive provider installed below 6.0.0 are exposed, since the flaw sits in code that Airflow loads when DAGs use Hive operators or hooks. Deployments without the Hive provider installed, or already on 6.0.0 or later, can skip it. The sources do not describe the exact input path, so whether a given DAG setup is reachable from outside is unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow-providers-apache-hive | pypi | < 6.0.0 | 6.0.0 |
| apache airflow hive provider | vendor | < 6.0.0 | 6.0.0 |
pip show apache-airflow-providers-apache-hive and confirm the installed version is below 6.0.0.pip freeze | grep apache-airflow-providers-apache-hive.apache-airflow-providers-apache-hive to 6.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2023-28706")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.