Live › vulnerability › CVE-2023-35797
Go to dashboardThe Apache Airflow Hive provider let a user bypass a security check through the principal parameter when calling Beeline. An attacker who can edit connection details can run arbitrary code on the Airflow worker.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:11 UTC, 0h before NVD. All times on this page are UTC.
Teams running Apache Airflow with the Hive provider installed at a version before 6.1.1 are exposed. The attack needs the ability to modify Hive connection details, so deployments where only trusted admins edit connections face less practical risk, but the fix is still a simple upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow-providers-apache-hive | pypi | < 6.1.1 | 6.1.1 |
| apache apache-airflow-providers-apache-hive | vendor | < 6.1.1 | 6.1.1 |
pip show apache-airflow-providers-apache-hive and confirm the version is below 6.1.1apache-airflow-providers-apache-hive to 6.1.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.
Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details.
It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2023-35797")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.