Apache Airflow Hive Provider Beeline RCE with Principal
Priority MEDIUM 54CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02791 86th percentileScored 2026-11-07
Fix Fixed Apache Airflow Apache Hive Provider (Apache Software Foundation): 6.1.1apache-airflow-providers-apache-hive (PyPI): 6.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Airflow Apache Hive Provider | before 6.1.1 | 6.1.1 | Patch available | CNA |
| — | apache-airflow-providers-apache-hive (PyPI) | before 6.1.1 | 6.1.1 | Patch available | GHSA-hg6c-qqcm-r79r |
- Apache Airflow Apache Hive Provider VendorApache Affected before 6.1.1 Fixed in 6.1.1 Patch available CNA
- apache-airflow-providers-apache-hive (PyPI) Vendor— Affected before 6.1.1 Fixed in 6.1.1 Patch available GHSA-hg6c-qqcm-r79r
Remediation
- Fix · CNA Apache Airflow Apache Hive Provider (Apache Software Foundation) Fixed in 6.1.1
- Fix · GHSA-hg6c-qqcm-r79r apache-airflow-providers-apache-hive (PyPI) Fixed in 6.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-35797
- 2026-10-03 Alias added: GHSA-hg6c-qqcm-r79r
References
Advisory 2
Other 5
- http://www.openwall.com/lists/oss-security/2023/07/12/3
- https://github.com/apache/airflow/commit/6724eeb6210d5965937eaf9dae3e476eb30f8268
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-apache-hive/PYSEC-2026-273.yaml
- https://pypi.org/project/apache-airflow-providers-apache-hive
More Apache-airflow-providers-apache-hive vulnerabilities
- TI-2022-22946 Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params CVSS 3.1CRITICAL 9.8
- TI-2023-10972 Apache Airflow Hive Provider Beeline RCE CVSS 3.1CRITICAL 9.8
- TI-2023-19029 Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user CVSS 3.1HIGH 8.8
- TI-2022-19650 Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection) CVSS 3.1HIGH 7.8
Sources
- CVE-2023-35797 · CVE Program
- CVE-2023-35797 · NVD
- FIRST EPSS
- GHSA-hg6c-qqcm-r79r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences