Medium · 6.5 CVE-2023-42663 BIT-airflow-2023-42663EUVD-2023-0020GHSA-32wr-qqw6-5mfpPYSEC-2023-197

Apache Airflow: Bypass permission verification to view task instances of other dags

Published Oct 14, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.
Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Airflow	< 2.7.2	2.7.2

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	apache-airflow	< 2.7.2	2.7.2	GHSA-32wr-qqw6-5mfp

References

https://github.com/apache/airflow/pull/34315 patch
https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9 vendor-advisory
http://www.openwall.com/lists/oss-security/2023/11/12/2