Description
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors.
Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Published: 2023-10-14
Score: 6.5 Medium
EPSS: 1.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-0022 Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors.\nUsers of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.\n\n
Github GHSA Github GHSA GHSA-cgx2-rrmr-jx43 Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs
History

No history.

Subscriptions

Apache Airflow
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2024-09-17T15:31:24.756Z

Reserved: 2023-09-14T06:28:34.137Z

Link: CVE-2023-42780

cve-icon Vulnrichment

Updated: 2024-08-02T19:30:24.199Z

cve-icon NVD

Status : Modified

Published: 2023-10-14T10:15:10.303

Modified: 2026-06-17T06:24:29.133

Link: CVE-2023-42780

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor