Apache AirflowGHSA-vm5m-qmrx-fw8w
Apache Airflow: Bypass permission verification to read code of other dags
High6.5CVE-2023-50944 · Published Jan 24, 2024 · updated Feb 13, 2025
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.8.1rc1 | 2.8.1rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-862
- Also known as
- BIT-airflow-2023-50944, CVE-2023-50944, PYSEC-2024-14
- nvd.nist.gov/vuln/detail/CVE-2023-50944
- github.com/apache/airflow/pull/36257
- github.com/apache/airflow/commit/8d76538d6e105947272b000581c6fabec20146b1
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-14.yaml
- lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h
- www.openwall.com/lists/oss-security/2024/01/24/5
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 242024 | Apache Airflow: pickle deserialization vulnerability in XComs High7.5Jan 24, 2024 | High7.5 | 2.8.1rc1 |
| Jan 242024 | Apache Airflow: cleartext storageMedium6.5Jan 24, 2024 | Medium6.5 | 2.6.1 |
| Dec 212023 | Apache Airflow Improper Access Control vulnerabilityMedium6.5Dec 21, 2023 | Medium6.5 | 2.8.0 |
| Dec 212023 | Apache Airflow Cross-Site Request Forgery vulnerabilityMedium6.5Dec 21, 2023 | Medium6.5 | 2.8.0 |
| Dec 212023 | Apache Airflow vulnerable to Exposure of Resource to Wrong SphereMedium4.3Dec 21, 2023 | Medium4.3 | 2.8.0 |
| Dec 212023 | Apache Airflow has a stored cross-site scripting vulnerabilityMedium5.4Dec 21, 2023 | Medium5.4 | 2.8.0b1 |