---
id: CVE-2023-34395
aliases:
  - GHSA-9766-v29c-4vm7
  - PYSEC-2026-1152
title: Apache Airflow ODBC Provider Argument Injection vulnerability
summary: Apache Airflow ODBC Provider Argument Injection vulnerability
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: apache-airflow-providers-odbc
product: apache-airflow-providers-odbc
ecosystem: pip
affected:
  - apache-airflow-providers-odbc < 4.0.0
patched:
  - apache-airflow-providers-odbc 4.0.0
published: '2023-06-27'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9766-v29c-4vm7'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-34395'
  - url: 'https://github.com/apache/airflow/pull/31713'
  - url: >-
      https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300
  - url: 'https://github.com/apache/airflow'
  - url: 'https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd'
tags:
  - osv
  - pip
epss: 0.00756
epssPercentile: 0.53247
ingestedAt: '2026-07-08T18:25:47.777Z'
---

## Overview

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.



## Affected packages

- `apache-airflow-providers-odbc < 4.0.0`

## Remediation

Upgrade to a patched release:

- `apache-airflow-providers-odbc 4.0.0`