CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection
First published: Fri Apr 04 2025(Updated: )
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have. This issue affects Apache Airflow Common SQL Provider: before 1.24.1. Users are recommended to upgrade to version 1.24.1, which fixes the issue.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow Common SQL Provider | <1.24.1 | |
| pip/apache-airflow-providers-common-sql | <1.24.1 | 1.24.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/48098
- https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2
- http://www.openwall.com/lists/oss-security/2025/04/04/2
- http://www.openwall.com/lists/oss-security/2025/04/06/1
- http://www.openwall.com/lists/oss-security/2025/04/06/2
- http://www.openwall.com/lists/oss-security/2025/04/06/3
- https://nvd.nist.gov/vuln/detail/CVE-2025-30473
- https://github.com/advisories/GHSA-5r62-mjf5-xwhj (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-30473?
CVE-2025-30473 has a medium severity rating due to the potential for SQL injection attacks.
How do I fix CVE-2025-30473?
To fix CVE-2025-30473, upgrade Apache Airflow Common SQL Provider to version 1.24.1 or later.
Who is affected by CVE-2025-30473?
Authenticated users using Apache Airflow Common SQL Provider version prior to 1.24.1 are vulnerable to CVE-2025-30473.
What type of vulnerability is CVE-2025-30473?
CVE-2025-30473 is classified as an SQL Injection vulnerability.
What are the potential impacts of CVE-2025-30473?
Exploitation of CVE-2025-30473 could allow an attacker to execute arbitrary SQL commands on the database.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-30473
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/description
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- agent/severity
- agent/references
- agent/last-modified-date
- agent/source
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5r62-mjf5-xwhj
- agent/tags
- agent/softwarecombine
- agent/event
- agent/trending
- vendor/apache
- canonical/apache airflow common sql provider
- package-manager/pip