Auth bypass in Apache Airflow
CVE-2023-50944
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.
Vulnerability class: Broken Access Control
EPSS: 0.010 (58.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Airflow
- Apache Software Foundation Airflow — versions 0
Weakness classification (CWE)
References
- security@apache.org (Third Party Advisory, patch)
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- security@apache.org (Mailing List)
Frequently asked questions
- What is CVE-2023-50944?
- CVE-2023-50944 is a medium-severity vulnerability in Apache Airflow, classified under Missing Authorization. CVSS score: 6.5/10. Published 2024-01-24.
- How severe is CVE-2023-50944?
- Medium severity. CVSS v3 base score is 6.5 out of 10.