oss-sec mailing list archives

CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection

From: Elad Kalif <eladkal () apache org>
Date: Fri, 04 Apr 2025 18:54:21 +0000

Severity: low

Affected versions:

- Apache Airflow Common SQL Provider before 1.24.1

Description:

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow 
Common SQL Provider.

When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated 
UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user.
This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally 
would not have.


This issue affects Apache Airflow Common SQL Provider: before 1.24.1.

Users are recommended to upgrade to version 1.24.1, which fixes the issue.

Credit:

nxczje (reporter)

References:

https://github.com/apache/airflow/pull/48098
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-30473

Current thread:

CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection Elad Kalif (Apr 04)
- Re: CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection Hanno Böck (Apr 06)
  - Re: CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection Solar Designer (Apr 06)
  - Re: CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection Jeffrey Walton (Apr 06)