Medium · 6.5 CVE-2023-42781 BIT-airflow-2023-42781EUVD-2023-0026GHSA-r7x6-xfcm-3mxvPYSEC-2023-231

Apache Airflow: Permission verification bypass allows viewing dagruns of other dags

Published Nov 12, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome.
Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Airflow	< 2.7.3	2.7.3

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	apache-airflow	< 2.7.3	2.7.3	GHSA-r7x6-xfcm-3mxv

References

https://github.com/apache/airflow/pull/34939 patch
https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1 vendor-advisory
http://www.openwall.com/lists/oss-security/2023/11/12/2