Apache Airflow Hive Provider Beeline RCE
Priority MEDIUM 53CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01982 80th percentileScored 2026-11-07
Fix Fixed Apache Airflow Hive Provider (Apache Software Foundation): 5.1.3apache-airflow-providers-apache-hive (PyPI): 5.1.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Airflow Hive Provider | before 5.1.3 | 5.1.3 | Patch available | CNA |
| — | apache-airflow-providers-apache-hive (PyPI) | before 5.1.3 | 5.1.3 | Patch available | GHSA-9mwf-mw74-9cv5 |
- Apache Airflow Hive Provider VendorApache Affected before 5.1.3 Fixed in 5.1.3 Patch available CNA
- apache-airflow-providers-apache-hive (PyPI) Vendor— Affected before 5.1.3 Fixed in 5.1.3 Patch available GHSA-9mwf-mw74-9cv5
Remediation
- Fix · CNA Apache Airflow Hive Provider (Apache Software Foundation) Fixed in 5.1.3
- Fix · GHSA-9mwf-mw74-9cv5 apache-airflow-providers-apache-hive (PyPI) Fixed in 5.1.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-25696
- 2026-10-03 Alias added: GHSA-9mwf-mw74-9cv5
References
Advisory 2
More Apache-airflow-providers-apache-hive vulnerabilities
- TI-2022-22946 Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params CVSS 3.1CRITICAL 9.8
- TI-2023-17885 Apache Airflow Hive Provider Beeline RCE with Principal CVSS 3.1CRITICAL 9.8
- TI-2023-19029 Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user CVSS 3.1HIGH 8.8
- TI-2022-19650 Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection) CVSS 3.1HIGH 7.8
Sources
- CVE-2023-25696 · CVE Program
- CVE-2023-25696 · NVD
- FIRST EPSS
- GHSA-9mwf-mw74-9cv5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences