CVE-2023-40195

Apache Airflow Spark Provider Deserialization Vulnerability RCE

State: Published
Severity: 8.8 High
Published: Aug 28, 2023
Updated: Apr 23, 2025
Reserved: Aug 10, 2023

Description

Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.

When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users.

To view the warning in the docs please visit https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-502 Deserialization of Untrusted Data
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Affected Products

Product	Versions
Apache Airflow Spark ProviderApache Software Foundation	before 4.1.3Affected

References

https://github.com/apache/airflow/pull/33233patch
https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.