CVE-2023-34395— Apache Airflow ODBC Provider: Remote code execution vulnerability
Quick assessment
Affected
Apache Software Foundation Apache Airflow ODBC Provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Airflow是美国阿帕奇（Apache）基金会的一套用于创建、管理和监控工作流程的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow ODBC Provider 4.0.0 之前版本存在参数注入漏洞，该漏洞源于在OdbcHook中，由于ODBC驱动程序允许加载任意动态链接库，从而导致命令执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-34395
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow ODBC Provider: Remote code execution vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Airflow 参数注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Airflow是美国阿帕奇（Apache）基金会的一套用于创建、管理和监控工作流程的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow ODBC Provider 4.0.0 之前版本存在参数注入漏洞，该漏洞源于在OdbcHook中，由于ODBC驱动程序允许加载任意动态链接库，从而导致命令执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow ODBC Provider | 0 ~ 4.0.0 | - |
|
II. Public POCs for CVE-2023-34395
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-34395
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-34395 (1)
Mailing List Discussions for CVE-2023-34395 (1)
-
https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd vendor-advisory
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-59267
Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE im -
CVE-2026-90632
Apache OpenOffice: Local file inclusion via GStreamer plugin -
CVE-2026-90634
Apache OpenOffice: Out-of-bounds write when importing encryp -
CVE-2026-90631
Apache OpenOffice: Remote document loaded without prompt, po -
CVE-2026-90629
Apache OpenOffice: Out of bounds memory access during WMF im
Same weakness: CWE-88
-
CVE-2026-97350
Local Privilege Escalation via OpenVPN Configuration and Pro -
CVE-2026-91909
Dell OpenManage Enterprise 4.8.0 前参数注入漏洞 -
CVE-2026-62968
Dream Displays has command-line argument injection in yt-dlp -
CVE-2026-116252
pgAdmin 4: Materialized view refresh redirects its connectio -
CVE-2026-111504
Dell OpenManage 4.8.0 前版本参数注入漏洞