CVE-2023-22884Critical· 9.8▾ AbyssalPoC availableCommand Injection in Apache Airflow and Apache Airflow MySQL Provider
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 2.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
11%
1 GitHub repo (last check)
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.
apache-airflow < 2.5.1apache-airflow-providers-mysql < 4.0.0Upgrade to a patched release:
apache-airflow 2.5.1apache-airflow-providers-mysql 4.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2022-40189Critical· 9.8OS Command Injection in Apache Airflow
CVE-2022-38649Critical· 9.8OS Command Injection in Apache Airflow
CVE-2026-32794Medium· 4.8Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
CVE-2024-41937Medium· 6.1Apache Airflow Cross-site Scripting Vulnerability
CVE-2026-34538Medium· 6.5Apache Airflow has an authorization bypass in DagRun wait endpoint
CVE-2026-22922Medium· 6.5Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access