CVE-2023-22884

Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

9.8 CriticalPublic exploitFix available

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

11.9%Up 10.9 points since Jan 22, 2023

What each source reports

NVD Score used 9.8

Record: CVE-2023-22884
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

CVE List 9.8

Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

Record: CVE-2023-22884
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

EUVDEUVD-2023-0440 9.8

Record: EUVD-2023-0440
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-c732-xvv8-g94c 9.8

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Record: GHSA-c732-xvv8-g94c
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

OSV 9.8

Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

Record: CVE-2023-22884
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

OSVGHSA-c732-xvv8-g94c 9.8

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Record: GHSA-c732-xvv8-g94c
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

Show 4 moreShow less

OSVPYSEC-2026-268 9.8

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Record: PYSEC-2026-268
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2026-279 9.8

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Record: PYSEC-2026-279
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-APP-PYPI-CVE-2023-22884 9.8

CVE-2023-22884 in rootio-apache-airflow-providers-mysql - Patched by Root

Root has patched CVE-2023-22884 in the rootio-apache-airflow-providers-mysql package for Root:PyPI. Multiple fixed versions available.

Record: ROOT-APP-PYPI-CVE-2023-22884
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBIT-airflow-2023-22884 No score

Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

Record: BIT-airflow-2023-22884
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apache-airflow` PyPI	before 2.5.1	2.5.1
`apache-airflow-providers-mysql` PyPI	before 4.0.0	4.0.0
`airflow` Bitnami	before 2.5.1	2.5.1
`apache-airflow` PyPI	before 2.5.1, plus listed versions 1.10.01.10.11.10.101.10.10rc11.10.10rc2 Show 45 moreShow less 1.10.10rc31.10.10rc41.10.10rc51.10.111.10.11rc11.10.11rc21.10.121.10.12rc11.10.12rc21.10.12rc31.10.12rc41.10.131.10.13rc11.10.141.10.14rc11.10.14rc21.10.14rc31.10.14rc41.10.151.10.15rc11.10.1b11.10.1rc21.10.21.10.2b21.10.2rc11.10.2rc21.10.2rc31.10.31.10.3b11.10.3b21.10.3rc11.10.3rc21.10.41.10.4b21.10.4rc11.10.4rc21.10.4rc31.10.4rc41.10.4rc51.10.51.10.5rc11.10.61.10.6rc11.10.6rc21.10.7	2.5.1
`apache-airflow-providers-mysql` PyPI	before 4.0.0, plus listed versions 1.0.01.0.0b11.0.0b21.0.0rc11.0.1 Show 39 moreShow less 1.0.1rc11.0.21.0.2rc11.1.01.1.0rc12.0.02.0.0rc12.0.0rc22.1.02.1.0rc12.1.0rc22.1.12.1.1rc12.2.02.2.0rc12.2.0rc22.2.12.2.1rc12.2.22.2.2rc12.2.32.2.3rc13.0.03.0.0rc13.0.0rc23.1.03.1.0rc13.2.03.2.0rc13.2.0rc23.2.0rc33.2.13.2.1rc13.3.03.3.0rc13.4.03.4.0rc23.4.0rc34.0.0rc1	4.0.0
`rootio-apache-airflow-providers-mysql` Root:PyPI	before 3.0.0+root.io.1	3.0.0+root.io.13.0.0+root.io.2
`apache-airflow-providers-mysql` Root:PyPI	before 3.0.0+aikido.2	3.0.0+aikido.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	jakabakos/CVE-2023-22884-Airflow-SQLi	2023-07-29

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-22884 is a critical vulnerability (CVSS 9.8) in Apache Airflow, published January 21, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.9%, the 96th percentile. Fixed in apache-airflow 2.5.1.

References

Show 4 moreShow less

This page doesn't list everything

Left out here: 84 versions. The JSON record has them.