CVE-2023-42780

Published: Oct 14, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Affected (1)

Products: Apache: Airflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Airflow	Before 2.7.2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/apache/airflow/pull/34355

Source: security@apache.org

Patch

https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d

Source: security@apache.org

Mailing ListVendor Advisory

https://github.com/apache/airflow/pull/34355

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.