id: PYSEC-2026-1137
published: "2026-07-07T11:45:22.484409Z"
modified: "2026-07-07T17:23:40.775090Z"
aliases:
- CVE-2023-39553
- GHSA-mq4v-6vg4-796c
summary: apache-airflow-providers-apache-drill Improper Input Validation vulnerability
details: |-
  Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.
  
  Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.
  This issue affects Apache Airflow Drill Provider before 2.4.3.
  It is recommended to upgrade to a version that is not affected.
affected:
- package:
    name: apache-airflow-providers-apache-drill
    ecosystem: PyPI
    purl: pkg:pypi/apache-airflow-providers-apache-drill
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.3
  versions:
  - 1.0.0
  - 1.0.0rc1
  - 1.0.0rc2
  - 1.0.1
  - 1.0.1rc1
  - 1.0.2
  - 1.0.2rc1
  - 1.0.3
  - 1.0.3rc1
  - 1.0.4
  - 1.0.4rc1
  - 2.0.0
  - 2.0.0rc1
  - 2.0.0rc2
  - 2.1.0
  - 2.1.0rc1
  - 2.2.0
  - 2.2.0rc1
  - 2.2.0rc2
  - 2.2.0rc3
  - 2.2.1
  - 2.2.1rc1
  - 2.3.0
  - 2.3.0rc1
  - 2.3.1
  - 2.3.1rc2
  - 2.3.1rc3
  - 2.3.2
  - 2.3.2rc1
  - 2.4.0
  - 2.4.0rc1
  - 2.4.0rc2
  - 2.4.1
  - 2.4.1rc1
  - 2.4.2
  - 2.4.2rc1
  - 2.4.3rc1
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2023-39553
- type: WEB
  url: https://github.com/apache/airflow/pull/33074
- type: WEB
  url: https://github.com/apache/airflow/commit/394a727ac2c18d58978bf186a7a92923460ec110
- type: PACKAGE
  url: https://github.com/apache/airflow
- type: WEB
  url: https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-136.yaml
- type: WEB
  url: https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf
- type: WEB
  url: https://www.openwall.com/lists/oss-security/2023/08/11/1
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2023/08/11/1
- type: PACKAGE
  url: https://pypi.org/project/apache-airflow-providers-apache-drill
- type: ADVISORY
  url: https://github.com/advisories/GHSA-mq4v-6vg4-796c
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N