Apache Airflow Providers Apache Hive

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:apache-airflow-providers-apache-hive:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorApache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95)
ProductApache Airflow Providers Apache Hive (79e14b3a-7a5c-51dc-b9a1-abab03999b02)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:apache/airflow purl2cpe 2026-06-01 10:14:29.613841
pkg:github/apache/airflow purl2cpe 2026-06-01 10:14:29.613844
pkg:pypi/apache-airflow-providers-apache-hive purl2cpe 2026-06-01 10:14:29.613847

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-37415 vulnerable 2026-06-08 06:08:15.275382 Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.
Published: 2023-07-13T07:35:33.474Z
Updated: 2025-02-13T17:01:18.439Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-35797 vulnerable 2026-06-08 06:06:27.771456 Apache Airflow Hive Provider Beeline RCE with Principal
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
Published: 2023-07-03T09:08:53.795Z
Updated: 2025-02-13T16:55:55.149Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-25696 vulnerable 2026-06-08 05:56:09.656203 Apache Airflow Hive Provider Beeline RCE
Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.
Published: 2023-02-24T11:48:21.189Z
Updated: 2024-10-23T19:10:47.536Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-46421 vulnerable 2026-06-08 05:50:38.879573 Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.
Published: 2022-12-20T10:20:39.431Z
Updated: 2025-04-16T18:10:28.787Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41131 vulnerable 2026-06-08 05:48:29.912704 Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the HIve Provider version 4.1.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Hive Provider installed).
Published: 2022-11-22T00:00:00.000Z
Updated: 2025-04-29T15:11:16.156Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.