---
id: "CVE-2023-35797"
kind: "vulnerability"
aliases: ["CVE-2023-35797", "GHSA-hg6c-qqcm-r79r"]
title: "Apache Airflow Hive Provider Beeline remote code execution with Principal"
severity: "critical"
cvss: 9.8
epss: 0.02791
exploited: false
status: "open"
category: "package"
products: [{"name": "apache-airflow-providers-apache-hive", "fixed": ["6.1.1"], "affected": "< 6.1.1", "ecosystem": "pypi"}, {"name": "apache apache-airflow-providers-apache-hive", "fixed": ["6.1.1"], "affected": "< 6.1.1", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["airflow", "cwe-20", "data-pipelines", "package", "python", "self-hosted"]
not_affected_if: ["connections-editable-only-by-trusted-admins", "hive-provider-not-installed", "provider-6.1.1-or-later"]
published_at: "2023-07-03T10:15:09+00:00"
first_seen_at: "2026-10-26T21:11:45+00:00"
updated_at: "2026-10-26T21:20:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hg6c-qqcm-r79r", "first_seen_at": "2026-10-26T21:11:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35797", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# Apache Airflow Hive Provider Beeline remote code execution with Principal

The Apache Airflow Hive provider let a user bypass a security check through the principal parameter when calling Beeline. An attacker who can edit connection details can run arbitrary code on the Airflow worker.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:apache-airflow-providers-apache-hive affected < 6.1.1 fixed 6.1.1
- vendor:apache apache-airflow-providers-apache-hive affected < 6.1.1 fixed 6.1.1

## How to check

- Run `pip show apache-airflow-providers-apache-hive` and confirm the version is below `6.1.1`
- Check whether any Airflow connection of type Hive/Beeline can be edited by users who should not be able to change it

## Fix

- Upgrade `apache-airflow-providers-apache-hive` to `6.1.1` or later
- Restrict who can create or edit Airflow connections until the upgrade is done

## Timeline

- 2026-10-26T21:11:45+00:00 ghsa https://github.com/advisories/GHSA-hg6c-qqcm-r79r
- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-35797

## From the sources

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider.
This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.

Before version 6.1.1 it was possible to bypass the security check to RCE via
principal parameter. For this to be exploited it requires access to modifying the connection details.

It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_