AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache AirflowGHSA-32wr-qqw6-5mfp

Apache Airflow vulnerable to sensitive information exposure

Apache Airflow

CVE-2023-42663 · Published Oct 14, 2023 · updated Feb 13, 2025

Medium6.5
Fix: upgrade to 2.7.2 or later
GitHub advisory

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user with access to read specific DAGs _only_ to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
< 2.7.22.7.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200
Also known as
BIT-airflow-2023-42663, CVE-2023-42663, PYSEC-2023-197

More Apache Airflow advisories

All Apache Airflow
High 6.5Nov 12, 2023Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-42781fixed in 2.7.3High 7.5Oct 28, 2023Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerabilityCVE-2023-46215fixed in 2.7.0Medium 4.3Oct 23, 2023Apache Airflow vulnerable to Exposure of Sensitive InformationCVE-2023-46288fixed in 2.7.2Medium 6.5Oct 14, 2023Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGsCVE-2023-42780fixed in 2.7.2Medium 4.3Oct 14, 2023Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-onlyCVE-2023-45348fixed in 2.7.2Medium 6.5Oct 14, 2023Apache Airflow vulnerable to privilege escalationCVE-2023-42792fixed in 2.7.2