CVE-2023-22884: Command Injection in Apache Airflow and Apache Airflow MySQL Provider
Summary
CVE-2023-22884: Command Injection in Apache Airflow and Apache Airflow MySQL Provider. Affects apache-airflow versions < 2.5.1. Fixed in 2.5.1. How to fix ↓
Also tracked for
- apache-airflow-providers-mysql · PyPI
- airflow · Bitnami
The same CVE-2023-22884 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling complex workflows. It allows users to define, schedule, and monitor workflows as directed acyclic graphs (DAGs) of tasks. Apache Airflow MySQL Provider is a plugin that enables Airflow to interact with MySQL databases. This vulnerability affects versions of Apache Airflow prior to 2.5.1 and Apache Airflow MySQL Provider prior to 4.0.0.
Vulnerability Detail
The vulnerability identified as CVE-2023-22884 is a Command Injection vulnerability. It occurs due to improper neutralization of special elements used in a command. This vulnerability allows an attacker to inject malicious commands into the affected software, potentially leading to arbitrary code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. It has been assigned CWE-77 as the Common Weakness Enumeration identifier.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading to the latest versions of Apache Airflow and Apache Airflow MySQL Provider.
Conclusion
In conclusion, the CVE-2023-22884 vulnerability in Apache Airflow and Apache Airflow MySQL Provider is a critical command injection issue that can lead to arbitrary code execution. It is crucial to upgrade to the latest versions of the affected software to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for orchestrating and scheduling complex workflows. It allows users to define, schedule, and monitor workflows as directed acyclic graphs (DAGs) of tasks.
Apache Airflow MySQL Provider is a plugin that enables Airflow to interact with MySQL databases. It provides additional functionality and connectivity options for Airflow workflows involving MySQL.
Command Injection is a vulnerability that occurs when an application allows user-supplied input to be executed as a command without proper validation or sanitization. This can lead to arbitrary command execution and potential compromise of the system.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8. It has the potential to be exploited by an attacker to execute arbitrary code and compromise the affected system.
To fix this vulnerability, it is recommended to upgrade Apache Airflow to version 2.5.1 or later and Apache Airflow MySQL Provider to version 4.0.0 or later. These updated versions contain patches and fixes to mitigate the command injection vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
