---
id: "CVE-2023-28706"
kind: "vulnerability"
aliases: ["CVE-2023-28706", "GHSA-5cvg-9pp5-mxcj"]
title: "Apache Airflow Hive Provider vulnerable to code injection"
severity: "critical"
cvss: 9.8
epss: 0.02765
exploited: false
status: "open"
category: "package"
products: [{"name": "apache-airflow-providers-apache-hive", "fixed": ["6.0.0"], "affected": "< 6.0.0", "ecosystem": "pypi"}, {"name": "apache airflow hive provider", "fixed": ["6.0.0"], "affected": "< 6.0.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["apache-airflow", "cwe-94", "data-pipelines", "package", "python", "self-hosted"]
not_affected_if: ["hive-provider-not-installed", "provider-6.0.0-or-later"]
published_at: "2023-04-07T15:15:08+00:00"
first_seen_at: "2026-10-26T21:11:45+00:00"
updated_at: "2026-10-26T21:20:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-5cvg-9pp5-mxcj", "first_seen_at": "2026-10-26T21:11:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28706", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# Apache Airflow Hive Provider vulnerable to code injection

The Apache Airflow Hive provider builds code from input it does not properly control, so crafted input can make it generate and run attacker-chosen code. An attacker who can reach that input path can run code in the Airflow worker or scheduler context.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:apache-airflow-providers-apache-hive affected < 6.0.0 fixed 6.0.0
- vendor:apache airflow hive provider affected < 6.0.0 fixed 6.0.0

## How to check

- Run `pip show apache-airflow-providers-apache-hive` and confirm the installed version is below `6.0.0`.
- Check the environment with `pip freeze | grep apache-airflow-providers-apache-hive`.

## Fix

- Upgrade `apache-airflow-providers-apache-hive` to `6.0.0` or later.
- Rebuild Airflow images or virtualenvs so the fixed provider is what runs.

## Timeline

- 2026-10-26T21:11:45+00:00 ghsa https://github.com/advisories/GHSA-5cvg-9pp5-mxcj
- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-28706

## From the sources

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_