Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability
Description
Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections.
It is recommended to upgrade to a version that is not affected. This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
apache-airflow-providers-apache-sqoopPyPI | < 4.0.0 | 4.0.0 |
Affected products
2- Range: 0
Patches
Vulnerability mechanics
Root cause
"Insufficient validation of the JDBC connection string in SqoopHook allows injection of arbitrary Sqoop command-line options via the schema field."
Attack vector
An attacker who is authenticated and authorized to create or edit Airflow connections can supply a malicious `schema` value containing query parameters (e.g., `schema?--evil-flag=value`). When `SqoopHook._prepare_command` builds the JDBC connection string, it appends the schema without sanitization, allowing the attacker to inject arbitrary Sqoop command-line options. Because Sqoop supports options like `--connect` that can execute arbitrary commands, this injection can lead to remote code execution on the Airflow worker. The attacker must have connection creation/edit permissions, but no additional network access is required beyond the Airflow web interface.
Affected code
The vulnerability resides in the `SqoopHook` class within `airflow/providers/apache/sqoop/hooks/sqoop.py`. The `_prepare_command` method constructs a JDBC connection string from user-supplied `host`, `port`, and `schema` fields without validating that the resulting string contains no query parameters. Additionally, the `import_table`, `import_query`, and `export_table` methods previously accepted `extra_import_options` and `extra_export_options` as direct arguments, allowing arbitrary Sqoop command-line flags to be injected. The operator in `airflow/providers/apache/sqoop/operators/sqoop.py` also passed these extra options through to the hook.
What the fix does
The patch [patch_id=1640925] moves the `'?'` validation check from `self.conn.host` to the constructed `connect_str`, ensuring the entire connection string is checked for query parameters rather than just the host field. This catches injection attempts via the `schema` field. The patch also removes `extra_import_options` and `extra_export_options` from the public hook methods (`import_table`, `import_query`, `export_table`) and consolidates them into a single `extra_options` parameter accepted only by the `SqoopHook` constructor. This prevents callers from passing arbitrary extra options at the point of command execution, reducing the attack surface. The operator is updated to pass `extra_options` through `_get_hook` when creating the hook instance.
Preconditions
- authAttacker must be authenticated and have authorization (permissions) to create or edit Airflow connections.
- configA Sqoop connection must be configured or configurable by the attacker.
- inputThe attacker must be able to supply a schema value containing query parameters (e.g., 'schema?param=value').
Generated on May 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/apache/airflow/pull/33039ghsapatchWEB
- github.com/advisories/GHSA-g3m9-pr5m-4cvpghsaADVISORY
- lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgdghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-27604ghsaADVISORY
News mentions
0No linked articles in our index yet.