# CVE-2023-25693: Apache Airflow Sqoop Provider improper input validation

Source: https://junglewise.ai/threats/cve-2023-25693-apache-airflow-sqoop-provider-improper-input-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-24. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2023-25693 · Severity: critical · CVSS 9.8 · Published 2023-02-24

The Apache Airflow Sqoop Provider, a tool used to transfer data between Apache Hadoop and structured datastores, contains a critical security flaw. This vulnerability allows an attacker to bypass security checks by providing improperly formatted input. If exploited, this could lead to unauthorized access to sensitive data or complete control over the data transfer process, potentially disrupting business operations and compromising customer information.

Technologies: [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-25693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-25693 being exploited in the wild.

**How severe is CVE-2023-25693?** Critical severity, with a CVSS score of 9.8, published 24 February 2023.

**Which products and versions are affected?** apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.1; apache-airflow-providers-apache-sqoop (PyPI) < 3.1.1, ECOSYSTEM:introduced=0,fixed=3.1.1.

**Is there a fix for CVE-2023-25693?** Yes. apache-airflow (PyPI): upgrade to 3.1.1 or later; apache-airflow-providers-apache-sqoop (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-25693 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-25693?** Check whether you run Apache Software Foundation Airflow Providers Apache Sqoop, apache-airflow (PyPI) or apache-airflow-providers-apache-sqoop (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-airflow (PyPI): upgrade to 3.1.1 or later

  ```sh
  pip install "apache-airflow>=3.1.1"
  ```

- apache-airflow-providers-apache-sqoop (PyPI): upgrade to 3.1.1 or later

  ```sh
  pip install "apache-airflow-providers-apache-sqoop>=3.1.1"
  ```


## Technical details

An improper input validation vulnerability (CWE-20) exists in the Apache Airflow Sqoop Provider prior to version 3.1.1. The flaw is related to how parameters like 'libjars' are handled within the Sqoop Hook and Operator. A remote attacker can exploit this by providing specially crafted input that is not correctly validated before being processed by the underlying Hadoop argument-parsing system. This can lead to unauthorized command execution or data access with the privileges of the Airflow worker. The issue was addressed in version 3.1.1 by moving the 'libjars' parameter from connection configuration to Hook parameters to ensure better control and validation.

## Affected products

- Apache apache-airflow-providers-apache-sqoop < 3.1.1

## Identifiers

- CVE-2023-25693
- GHSA-j69x-v4wc-3fpf
- PYSEC-2023-314
- PYSEC-2026-275

## Timeline

- 2023-02-12: other: Pull request to fix the issue submitted
- 2023-02-24: advisory: Initial disclosure and GHSA/CVE publication
- 2023-02-24: patched: Version 3.1.1 released

## References

- [https://github.com/apache/airflow/pull/29500](https://github.com/apache/airflow/pull/29500)
- [https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4](https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4)
- [https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-314.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-314.yaml)

## Related threats

- [Apache Airflow Core API logout incomplete token revocation](https://junglewise.ai/threats/cve-2026-86473-apache-airflow-the-core-api-logout-endpoint-revokes-only-a)
- [Apache Airflow authentication bypass via session cookie precedence](https://junglewise.ai/threats/cve-2026-82355-when-a-request-to-the-airflow-core-api-carries-both-a-session)
- [Apache Airflow information disclosure in /assets/events API](https://junglewise.ai/threats/cve-2026-75158-apache-airflow-s-assets-events-api-returned-asset-events-for)
- [Apache Airflow authorization bypass in asset materialization and XCom endpoints](https://junglewise.ai/threats/cve-2026-68971-apache-airflow-authorization-bypass-in-asset-materialization-and)
- [Apache Airflow Task SDK variable masking bypass for list-shaped values](https://junglewise.ai/threats/cve-2026-68970-apache-airflow-task-sdk-variable-masking-bypass-for-list-shaped)