---
id: CVE-2023-35798
aliases:
  - GHSA-q57w-826p-46jr
  - PYSEC-2026-1150
title: >-
  Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input
  Validation vulnerability
summary: >-
  Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input
  Validation vulnerability
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
vendor: apache-airflow-providers-odbc
product: apache-airflow-providers-odbc
ecosystem: pip
affected:
  - apache-airflow-providers-odbc < 4.0.0
  - apache-airflow-providers-microsoft-mssql < 3.4.1
patched:
  - apache-airflow-providers-odbc 4.0.0
  - apache-airflow-providers-microsoft-mssql 3.4.1
published: '2023-06-27'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-q57w-826p-46jr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-35798'
  - url: 'https://github.com/apache/airflow/pull/31984'
  - url: >-
      https://github.com/apache/airflow/commit/b6836986846058e9e5fa271fb7b22ae721020787
  - url: 'https://github.com/apache/airflow'
  - url: 'https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj'
tags:
  - osv
  - pip
epss: 0.01263
epssPercentile: 0.68423
ingestedAt: '2026-07-08T18:25:52.094Z'
---

## Overview

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected



## Affected packages

- `apache-airflow-providers-odbc < 4.0.0`
- `apache-airflow-providers-microsoft-mssql < 3.4.1`

## Remediation

Upgrade to a patched release:

- `apache-airflow-providers-odbc 4.0.0`
- `apache-airflow-providers-microsoft-mssql 3.4.1`