Sqoop Apache Airflow Provider Remote Code Execution Vulnerability
Priority MEDIUM 53CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01895 79th percentileScored 2026-11-07
Fix Fixed Apache Airflow Sqoop Provider (Apache Software Foundation): 3.1.1apache-airflow-providers-apache-sqoop (PyPI): 3.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Airflow Sqoop Provider | before 3.1.1 | 3.1.1 | Patch available | CNA |
| — | apache-airflow-providers-apache-sqoop (PyPI) | before 3.1.1 | 3.1.1 | Patch available | GHSA-j69x-v4wc-3fpf |
- Apache Airflow Sqoop Provider VendorApache Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
- apache-airflow-providers-apache-sqoop (PyPI) Vendor— Affected before 3.1.1 Fixed in 3.1.1 Patch available GHSA-j69x-v4wc-3fpf
Remediation
- Fix · CNA Apache Airflow Sqoop Provider (Apache Software Foundation) Fixed in 3.1.1
- Fix · GHSA-j69x-v4wc-3fpf apache-airflow-providers-apache-sqoop (PyPI) Fixed in 3.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-25693
- 2026-10-03 Alias added: GHSA-j69x-v4wc-3fpf
References
Advisory 2
Other 4
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-apache-sqoop/PYSEC-2026-275.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-314.yaml
- https://pypi.org/project/apache-airflow-providers-apache-sqoop
Sources
- CVE-2023-25693 · CVE Program
- CVE-2023-25693 · NVD
- FIRST EPSS
- GHSA-j69x-v4wc-3fpf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences