AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowPYSEC-2023-136

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider

Apache Airflow

CVE-2023-39553 · Published Aug 11, 2023 · updated Jul 7, 2026

High7.5
Fix: upgrade to 2.4.3 or later
Source advisory

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.

Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.

This issue affects Apache Airflow Drill Provider: before 2.4.3.

It is recommended to upgrade to a version that is not affected.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
< 2.4.32.4.3

Changes since it was listed

SeveritySep 24Severity: Unrated to High
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
NVD
Also known as
CVE-2023-39553, GHSA-mq4v-6vg4-796c, PYSEC-2026-1137

More Apache Airflow advisories

All Apache Airflow
High 8.1Aug 23, 2023Apache Airflow denial of service vulnerabilityCVE-2023-37379fixed in 2.7.0b1High 8.0Aug 23, 2023Apache Airflow Session Fixation vulnerabilityCVE-2023-40273fixed in 2.7.0rc2Medium 5.9Aug 23, 2023Apache Airflow missing Certificate ValidationCVE-2023-39441fixed in 2.7.0High 8.8Aug 5, 2023Apache Airflow Execution with Unnecessary PrivilegesCVE-2023-39508fixed in 2.6.0b1High 6.5Jul 12, 2023Apache Airflow Incorrect Authorization vulnerabilityCVE-2023-35908fixed in 2.6.3High 6.5Jul 12, 2023Apache Airflow Improper Input Validation vulnerabilityCVE-2023-36543fixed in 2.6.3