CVE-2023-25692
Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service
CVE-2023-25692 is a high vulnerability (CVSS 7.5) in Apache Software Foundation Airflow Google Provider, published February 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 79th percentile. Fixed in apache-airflow-providers-google 8.10.0.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 1.83%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.10.0apache-airflow-providers-google +3 more
Description
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflow-providers-googlePyPI | before 8.10.0 | 8.10.0 |
apache-airflow-providers-googlePyPI | before 8.10.0, plus listed versions 1.0.01.0.0b11.0.0b21.0.0rc12.0.0 Show 45 moreShow less2.0.0rc12.1.02.1.0rc12.2.02.2.0rc13.0.03.0.0rc14.0.04.0.0rc14.0.0rc24.1.0rc15.0.05.0.0rc25.1.05.1.0rc16.0.06.0.0rc16.1.06.1.0rc16.2.06.2.0rc16.3.06.3.0rc16.4.06.4.0rc16.4.0rc26.4.0rc36.5.06.5.0rc16.6.06.6.0rc16.7.06.7.0rc16.8.06.8.0rc17.0.07.0.0rc18.0.08.0.0rc18.0.0rc28.1.08.1.0rc18.10.0rc18.2.08.2.0rc1 | 8.10.0 |
rootio-apache-airflow-providers-googleRoot:PyPI | before 8.1.0+root.io.1 | 8.1.0+root.io.18.1.0+root.io.28.1.0+root.io.3 |
apache-airflow-providers-googleRoot:PyPI | before 8.1.0+aikido.3 | 8.1.0+aikido.3 |
What each source reports
NVD Score used
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
- Record
CVE-2023-25692- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List
Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
- Record
CVE-2023-25692- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-0716
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
- Record
EUVD-2023-0716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h8p2-8g72-qpgh
Apache Airflow Google Provider Improper Input Validation vulnerability
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
- Record
GHSA-h8p2-8g72-qpgh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
- Record
CVE-2023-25692- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-h8p2-8g72-qpgh
Apache Airflow Google Provider Improper Input Validation vulnerability
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
- Record
GHSA-h8p2-8g72-qpgh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2026-774
Apache Airflow Google Provider Improper Input Validation vulnerability
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
- Record
PYSEC-2026-774- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2023-25692
CVE-2023-25692 in rootio-apache-airflow-providers-google - Patched by Root
Root has patched CVE-2023-25692 in the rootio-apache-airflow-providers-google package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2023-25692- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/apache/airflow/pull/29499
lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh
nvd.nist.gov/vuln/detail/CVE-2023-25692
pypi.org/project/apache-airflow-providers-google
Left out here: 19 versions. The JSON record has them.