Advisoriesby IbisApache AirflowGHSA-269x-pg5c-5xgm
Apache Airflow Execution with Unnecessary Privileges
Fix: upgrade to 2.6.0b1 or later
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0.
This issue affects Apache Airflow: before 2.6.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.6.0b1 | 2.6.0b1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-airflow-2023-39508, CVE-2023-39508, PYSEC-2023-134
- nvd.nist.gov/vuln/detail/CVE-2023-39508
- github.com/apache/airflow/pull/29706
- github.com/apache/airflow/commit/101d59c4b88ab979d305b8d96f612c27c8a44aa8
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-134.yaml
- lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15
- seclists.org/fulldisclosure/2023/Jul/43
More Apache Airflow advisories
All Apache Airflow
Apache Airflow denial of service vulnerabilityCVE-2023-37379fixed in 2.7.0b1Apache Airflow Session Fixation vulnerabilityCVE-2023-40273fixed in 2.7.0rc2Apache Airflow missing Certificate ValidationCVE-2023-39441fixed in 2.7.0Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill ProviderCVE-2023-39553fixed in 2.4.3Apache Airflow Incorrect Authorization vulnerabilityCVE-2023-35908fixed in 2.6.3Apache Airflow Improper Input Validation vulnerabilityCVE-2023-36543fixed in 2.6.3