All vulnerabilities
CVE-2023-35797GHSA-hg6c-qqcm-r79rPYSEC-2026-273

apache-airflow-providers-apache-hive: Apache Airflow Hive Provider Beeline remote code execution with Principal

Apache Software Foundation apache-airflow-providers-apache-hivepipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)2.79%Chance of exploitation activity in the next 30 days, higher than 86% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed in6.1.1Fixed versionGitHub
Published3 Jul 2023Updated 26 Oct 2026CVE List

What fixes it

  • 6.1.1apache-airflow-providers-apache-hive, pipGitHub
  • 6.1.1Apache Airflow Apache Hive ProviderCVE List
  • 6.1.1apache-airflow-providers-apache-hive, PyPIOSVpip install "apache-airflow-providers-apache-hive>=6.1.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.

Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details.

It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.

Text from GitHub Advisory Database

Affected versions 53

  • apache-airflow-providers-apache-hive, pip< 6.1.1GitHub
  • Apache Airflow Apache Hive Provideraffected: all versions before 6.1.1CVE List
  • apache-airflow-providers-apache-hive, PyPIfrom first release, fixed in 6.1.1OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.0OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.0b1OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.0b2OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.1OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.1rc1OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.2OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.2rc1OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.3OSV
  • apache-airflow-providers-apache-hive, PyPI1.0.3rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.0OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.0rc2OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.1OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.1rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.1rc2OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.2OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.2rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.3OSV
  • apache-airflow-providers-apache-hive, PyPI2.0.3rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.1.0OSV
  • apache-airflow-providers-apache-hive, PyPI2.1.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.2.0OSV
  • apache-airflow-providers-apache-hive, PyPI2.2.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.2.0rc2OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.0OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.1OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.1rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.2OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.2rc1OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.3OSV
  • apache-airflow-providers-apache-hive, PyPI2.3.3rc1OSV
  • apache-airflow-providers-apache-hive, PyPI3.0.0OSV
  • apache-airflow-providers-apache-hive, PyPI3.0.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI3.0.0rc2OSV
  • apache-airflow-providers-apache-hive, PyPI3.1.0OSV
  • apache-airflow-providers-apache-hive, PyPI3.1.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI4.0.0OSV
  • apache-airflow-providers-apache-hive, PyPI4.0.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI4.0.0rc2OSV
  • apache-airflow-providers-apache-hive, PyPI4.0.0rc3OSV
  • apache-airflow-providers-apache-hive, PyPI4.0.1OSV
  • apache-airflow-providers-apache-hive, PyPI4.0.1rc1OSV
  • apache-airflow-providers-apache-hive, PyPI4.1.0OSV
  • apache-airflow-providers-apache-hive, PyPI4.1.0rc1OSV
  • apache-airflow-providers-apache-hive, PyPI4.1.1OSV
  • apache-airflow-providers-apache-hive, PyPI4.1.1rc2OSV
  • apache-airflow-providers-apache-hive, PyPI4.1.1rc3OSV
  • apache-airflow-providers-apache-hive, PyPI5.0.0OSV

References 7