Apache Airflow Spark Provider Deserialization Vulnerability RCE

CVE-2023-40195

Summary

The vulnerability involves the deserialization of untrusted data in the Apache Airflow Spark Provider, allowing authorized users to execute arbitrary code on the Airflow node by misconfiguring it to interact with a malicious Spark server. Prior to version 4.1.3, this issue wasn’t clearly documented, which may have led administrators to unknowingly grant too much access. It’s crucial that administrators review their configurations and restrict permissions to configure Spark hooks exclusively to trusted individuals, as this can mitigate the risk of exploitation.

References