CVE-2023-35798 Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

What is CVE-2023-35798?

CVE-2023-35798 is a medium-severity path traversal vulnerability in Apache Airflow MSSQL Provider, published on 27 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Weakness: CWE-20

Which versions are affected by CVE-2023-35798?

6 open source packages ship an affected version, including apache-airflow-providers-microsoft-mssql and apache-airflow-providers-odbc. It affects 2 products.

Products include Apache Apache-Airflow-Providers-Microsoft-Mssql, Apache Apache-Airflow-Providers-Odbc.

How do I fix CVE-2023-35798?

Upgrade apache-airflow-providers-microsoft-mssql to 3.4.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-35798 being exploited?

There is no known exploitation of CVE-2023-35798 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q57w-826p-46jr, PYSEC-2026-1150, PYSEC-2026-2370.