Advisoriesby IbisApache AirflowGHSA-j3w8-2p2h-mrr9
Apache Airflow vulnerable to privilege escalation
Fix: upgrade to 2.7.2 or later
Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't.
Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.7.2 | 2.7.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-668
- Also known as
- BIT-airflow-2023-42792, CVE-2023-42792, PYSEC-2023-203
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-42781fixed in 2.7.3Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerabilityCVE-2023-46215fixed in 2.7.0Apache Airflow vulnerable to Exposure of Sensitive InformationCVE-2023-46288fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposureCVE-2023-42663fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGsCVE-2023-42780fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-onlyCVE-2023-45348fixed in 2.7.2