SQL Injection in Apache Airflow Common Sql Provider
CVE-2025-30473
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have. This issue affects Apache Airflow Common SQL Provider: before 1.24.1. Users are recommended to upgrade to version 1.24.1, which fixes the issue.
Vulnerability class: SQL Injection
EPSS: 0.008 (53.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Patch, patch, Issue Tracking)
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
Frequently asked questions
- What is CVE-2025-30473?
- CVE-2025-30473 is a high-severity vulnerability in Apache Airflow Common Sql Provider, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-04-07.
- How severe is CVE-2025-30473?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2025-30473 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.