AVID-2026-R1180

Description

Apache Airflow JDBC Provider: RCE Vulnerability (CVE-2023-22886)

Details

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission. This issue affects Apache Airflow JDBC Provider: before 4.0.0.

Reason for inclusion in AVID: The CVE describes an RCE vulnerability in Apache Airflow JDBC Provider. Airflow is widely used in ML/AI pipelines for orchestration, serving as a software component in the AI stack. This affects a component (Airflow JDBC Provider) used to build/run AI workflows, i.e., a software supply chain element for general-purpose AI systems. It is a security vulnerability with clear CVE description and references.

References

• NVD entry
• https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3

Affected or Relevant Artifacts

• Developer: Apache Software Foundation
• Deployer: Apache Software Foundation
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2023-06-29
• Version: 0.3.3
• AVID Entry