CVE-2023-40195

    Dashboard / Vulnerabilities / CVE-2023-40195

    CVE-2023-40195

    Published: 28 Aug 2023Last Modified: 12 Aug 2026

    Summary: Apache Airflow Spark Provider Deserialization Vulnerability RCE

    Details: Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users. To view the warning in the docs please visit  https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40195.json, https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24, https://nvd.nist.gov/vuln/detail/CVE-2023-40195, https://github.com/apache/airflow/pull/33233

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7ab6dc2ecf362916cde19f2c761cb3103dbc824b

    Affected versions

    go-sdk/v1.0.0-beta1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40195 | CVE-DB