{"id":"CVE-2023-34395","aliases":["GHSA-9766-v29c-4vm7","PYSEC-2026-1152"],"title":"Apache Airflow ODBC Provider Argument Injection vulnerability","summary":"Apache Airflow ODBC Provider Argument Injection vulnerability","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"apache-airflow-providers-odbc","product":"apache-airflow-providers-odbc","ecosystem":"pip","affected":["apache-airflow-providers-odbc < 4.0.0"],"patched":["apache-airflow-providers-odbc 4.0.0"],"published":"2023-06-27","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9766-v29c-4vm7","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34395"},{"url":"https://github.com/apache/airflow/pull/31713"},{"url":"https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300"},{"url":"https://github.com/apache/airflow"},{"url":"https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd"}],"tags":["osv","pip"],"epss":0.00756,"epssPercentile":0.53714,"ingestedAt":"2026-07-08T18:25:47.777Z","slug":"CVE-2023-34395","body":"## Overview\n\nImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.\nIn OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.\nStarting version 4.0.0 driver can be set only from the hook constructor.\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0.\n\n\n\n## Affected packages\n\n- `apache-airflow-providers-odbc < 4.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-airflow-providers-odbc 4.0.0`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}