CVE-2023-22884: Apache Airflow

Critical severity, CVSS 9.8. EPSS: 11.1% chance of exploitation in the next 30 days.

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

Affected products

• Apache Airflow: before 2.5.1 (fixed in 2.5.1)
• Apache Apache-Airflow-Providers-MySQL: before 4.0.0 (fixed in 4.0.0)

Published 2023-01-21. Last modified 2026-06-17.