CVE-2022-41131 json
Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)
published 2022-11-22 3 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2022-41131 , EUVD-2022-7313 , GHSA-cm43-f2pv-6v68 , PYSEC-2026-772
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the HIve Provider version 4.1.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Hive Provider installed).
Patch / fix
- pypi apache-airflow-providers-apache-hive 4.1.0
- bitnami airflow 2.3.0
- Apache Software Foundation Apache Airflow Hive Provider 4.1.0
- github.com/apache/airflow#27647 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
1.76% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow-providers-apache-hive | <4.1.0 |
4.1.0 |
| bitnami | airflow | <2.3.0 |
2.3.0 |
Affected products
- Apache Software Foundation Apache Airflow Hive Provider
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/apache/airflow/pull/27647
web, patch, third-party-advisory, advisory
-
lists.apache.org
/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl
web, issue-tracking, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-41131
advisory, web
-
github.com
/apache/airflow
package
-
pypi.org
/project/apache-airflow-providers-apache-hive
package
-
github.com
/advisories/GHSA-cm43-f2pv-6v68
advisory
Sources
- CVE List CVE-2022-41131
- GitHub Advisory GHSA-cm43-f2pv-6v68
- NVD CVE-2022-41131
- OSV BIT-airflow-2022-41131
- OSV PYSEC-2026-772
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.