Every CVE Search/ Get API key

CVE-2023-35798

Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

4.3 MediumFix available

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.26%Up 1.2 points since Jun 28, 2023
90%50%10%1%

What each source reports

NVD Score used 4.3

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
CVE-2023-35798
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
CVE-2023-35798
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2023-1863 0.0

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
EUVD-2023-1863
CVSS
0.0 NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-q57w-826p-46jr 4.3

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
GHSA-q57w-826p-46jr
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-q57w-826p-46jr 4.3

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
GHSA-q57w-826p-46jr
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVPYSEC-2026-1150 4.3

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
PYSEC-2026-1150
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVPYSEC-2026-2370 4.3

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
PYSEC-2026-2370
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV No score

Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get_sqlalchemy_connection and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Record
CVE-2023-35798
Weakness
CWE-20
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache-airflow-providers-odbc
PyPI
 before 4.0.0
4.0.0
apache-airflow-providers-microsoft-mssql
PyPI
 before 3.4.1
3.4.1
apache-airflow-providers-odbc
PyPI
 before 4.0.0, plus listed versions
1.0.01.0.0b11.0.0b21.0.0rc11.0.1
Show 32 moreShow less
1.0.1rc12.0.02.0.0rc12.0.0rc22.0.12.0.1rc12.0.22.0.2rc12.0.32.0.3rc12.0.42.0.4rc13.0.03.0.0rc13.0.0rc23.1.03.1.0rc13.1.13.1.1rc13.1.1rc23.1.1rc33.1.23.1.2rc13.2.03.2.0rc13.2.13.2.1rc23.2.1rc33.3.03.3.0rc13.3.0rc24.0.0rc1
4.0.0
apache-airflow-providers-microsoft-mssql
PyPI
 before 3.4.1, plus listed versions
1.0.01.0.0b11.0.0b21.0.0rc11.0.1
Show 40 moreShow less
1.0.1rc11.1.01.1.0rc12.0.02.0.0rc12.0.0rc22.0.12.0.1rc12.1.02.1.0rc12.1.0rc22.1.12.1.1rc12.1.22.1.2rc12.1.32.1.3rc13.0.03.0.0rc13.0.0rc23.1.03.1.0rc13.2.03.2.0rc13.2.0rc23.2.0rc33.2.13.2.1rc13.3.03.3.0rc13.3.13.3.1rc23.3.1rc33.3.23.3.2rc13.3.2rc23.4.03.4.0rc13.4.0rc23.4.1rc1
3.4.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-35798 is a medium vulnerability (CVSS 4.3) in Apache Software Foundation Airflow Mssql Provider, published June 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in apache-airflow-providers-odbc 4.0.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open