A critical security vulnerability has been detected in the Apache Airflow MySQL Provider library that could allow threat actors to execute remote code in affected installations. Apache Airflow is an open-source workflow management platform used to programmatically write, schedule, and monitor workflows. The MySQL Provider is a library used to provide a MySQL connection.
The vulnerability, identified by the code CVE-2023-22884, is a command injection security vulnerability affecting versions of Apache Airflow prior to 2.5.1 and Apache Airflow MySQL Provider prior to 4.0.0. A remote threat actor can execute arbitrary commands on the target system by sending specially crafted data to the application.
It is recommended to upgrade to the current versions that fix the vulnerability as soon as possible to avoid being targeted by attacks that can be carried out using the vulnerability.
What do the official records say?
The National Vulnerability Database entry for CVE-2023-22884 was published on 21 January 2023. It describes an improper neutralization of special elements used in a command, which is command injection. It affects Apache Airflow before 2.5.1 and the Apache Airflow MySQL Provider before 4.0.0. NVD gives it a CVSS 3.1 base score of 9.8, which is critical.
The Apache project’s own Airflow security page lists an advisory record that uses a different short title: “Arbitrary file read via MySQL provider in Apache Airflow”. It points to the code change that fixed the problem and to the Apache announcement linked above. The two descriptions stress different effects, so read the Apache record and the code change if you need to know exactly what an attacker could do on your system.
Who is affected and what should you do?
Any deployment that runs Airflow earlier than 2.5.1 or the MySQL provider earlier than 4.0.0 is in scope. The fixed releases are Airflow 2.5.1 and MySQL provider 4.0.0, so those are the lowest versions that carry the fix. Airflow often sits close to data stores and holds connection details, so a flaw here can lead to wider access.
- Find every Airflow instance and note the Airflow version and the version of the MySQL provider package.
- Upgrade the MySQL provider to 4.0.0 or later and Airflow to 2.5.1 or later.
- Limit who can reach the Airflow web interface and who can edit connections and workflows.
- Review recent logs for unusual database commands or unexpected file reads.
Our glossary pages on patch management and vulnerability management explain how to make such upgrades routine.