CVE-2023-41267
Apache HDFS Provider error message suggested installation of incorrect pip package
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
- Record
CVE-2023-41267- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
CVE ListNo score
Apache HDFS Provider error message suggested installation of incorrect pip package
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
- Record
CVE-2023-41267- Weakness
- CWE-829
- Updated
- 2026-11-02
EUVDEUVD-2023-2432
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
- Record
EUVD-2023-2432- CVSS
- 0.0 None
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5hj9-m76g-xrc8
Apache HDFS Provider error message suggested
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
- Record
GHSA-5hj9-m76g-xrc8- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
OSVGHSA-5hj9-m76g-xrc8
Apache HDFS Provider error message suggested
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
- Record
GHSA-5hj9-m76g-xrc8- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
OSVPYSEC-2026-1138
Apache HDFS Provider error message suggested
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
- Record
PYSEC-2026-1138- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVNo score
Apache HDFS Provider error message suggested installation of incorrect pip package
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
- Record
CVE-2023-41267- Weakness
- CWE-829
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflow-providers-apache-hdfsPyPI | before 4.1.1 | 4.1.1 |
apache-airflow-providers-apache-hdfsPyPI | before 4.1.1, plus listed versions 1.0.01.0.0b11.0.0b21.0.0rc11.0.1 Show 35 moreShow less1.0.1rc12.0.02.0.0rc12.0.0rc22.1.02.1.0rc12.1.12.1.1rc12.2.02.2.0rc12.2.12.2.1rc12.2.22.2.2rc12.2.32.2.3rc13.0.03.0.0rc13.0.0rc23.0.13.0.1rc13.1.03.1.0rc13.1.0rc23.1.0rc33.2.03.2.0rc13.2.13.2.1rc14.0.04.0.0rc14.0.0rc24.1.04.1.0rc14.1.1rc1 | 4.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41267 is a high vulnerability (CVSS 7.8) in Apache Airflow Hdfs Provider, published September 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. Fixed in apache-airflow-providers-apache-hdfs 4.1.1.
References
github.com/apache/airflow/pull/33813
lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z
openwall.com/lists/oss-security/2023/09/14/3
nvd.nist.gov/vuln/detail/CVE-2023-41267
pypi.python.org
pypi.org/project/apache-airflow-providers-apache-hdfs