AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowPYSEC-2023-3

Apache Airflow: improper input validation

Apache Airflow

CVE-2023-28707 · Published Apr 7, 2023 · updated Jul 7, 2026

High7.5
Fix: upgrade to 2.3.2 or later
Source advisory

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
< 2.3.22.3.2

Changes since it was listed

SeveritySep 24Severity: Unrated to High
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
NVD
Also known as
CVE-2023-28707, GHSA-85pf-r4c7-3j9r, PYSEC-2026-1136

More Apache Airflow advisories

All Apache Airflow
High 6.5Jun 19, 2023Apache Airflow vulnerable to exposure of sensitive informationCVE-2023-35005fixed in 2.6.2rc1Critical 9.8May 8, 2023Apache Airflow vulnerable to Privilege Context Switching ErrorCVE-2023-25754fixed in 2.6.0b1Medium 5.4May 8, 2023Apache Airflow vulnerable to stored Cross-site ScriptingCVE-2023-29247fixed in 2.6.0Medium 5.3Mar 15, 2023Sensitive Information in Error Messages in Apache AirflowCVE-2023-25695fixed in 2.5.2rc1Critical 9.8Feb 24, 2023Improper Input Validation vulnerability in the Apache Airflow Sqoop ProviderCVE-2023-25693fixed in 3.1.1Critical 9.8Jan 21, 2023Command Injection in Apache Airflow and Apache Airflow MySQL ProviderCVE-2023-22884fixed in 2.5.1