Apache AirflowGHSA-wpg8-mf6h-gm92
Apache Airflow Incorrect Authorization vulnerability
Medium4.3CVE-2023-40611 · Published Sep 12, 2023 · updated Feb 13, 2025
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.7.1 | 2.7.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- BIT-airflow-2023-40611, CVE-2023-40611, PYSEC-2023-170
- nvd.nist.gov/vuln/detail/CVE-2023-40611
- github.com/apache/airflow/pull/33413
- github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad
- github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-170.yaml
- lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0
- www.openwall.com/lists/oss-security/2023/11/12/1
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 142023 | Apache Airflow vulnerable to privilege escalation Medium6.5Oct 14, 2023 | Medium6.5 | 2.7.2 |
| Sep 122023 | Apache Airflow information exposure vulnerabilityHigh6.5Sep 12, 2023 | High6.5 | 2.7.1 |
| Aug 232023 | Apache Airflow missing Certificate ValidationMedium5.9Aug 23, 2023 | Medium5.9 | 2.7.0 |
| Aug 232023 | Apache Airflow Session Fixation vulnerabilityHigh8.0Aug 23, 2023 | High8.0 | 2.7.0rc2 |
| Aug 232023 | Apache Airflow denial of service vulnerabilityHigh8.1Aug 23, 2023 | High8.1 | 2.7.0b1 |
| Aug 112023 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill ProviderHigh7.5Aug 11, 2023 | High7.5 | 2.4.3 |