CVE-2023-40272

HighCVSS 7.5

Published: 17/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.67%

74th percentile - higher than 74% of all known CVEs

Summary

Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection, giving an opportunity to read files on the Airflow server.

Risk Assessment

This vulnerability poses a risk of unauthorized access to data on the Airflow server, potentially leading to the exposure of sensitive information.

Recommendation

It is recommended to upgrade to a version that is not affected.

Other vulnerabilities in Apache Airflow Spark Provider

CVE-2023-40195High
CVE-2023-40195 involves deserialization of untrusted data in the Apache Airflow Spark Provider, allowing authorized users to execute arbitrary code on the Airflow node by pointing to a malicious Spark server.

Original NVD description (English source)

Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade to a version that is not affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS