Apache Airflow vulnerable to sensitive information exposure

MEDIUM 6.5CVE-2023-42663 · BIT-airflow-2023-42663 · GHSA-32wr-qqw6-5mfp · Published 14/10/2023 · updated 17/06/2026

In short

CVE-2023-42663 is a MEDIUM (CVSS 6.5) vulnerability affecting apache-airflow, airflow (apache).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.9% of all vulnerabilities.
Fix: update to 2.7.2 or later.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.7.2`	`2.7.2`
airflow apache	`< 2.7.2`	`2.7.2`

Description

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user with access to read specific DAGs only to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

NVD description

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2023-42663 · ADVISORY
apache/airflow#34315 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9 · WEB
openwall.com/lists/oss-security/2023/11/12/2 · WEB
GitHub Advisory GHSA-32wr-qqw6-5mfp · ADVISORY

More vulnerabilities in apache-airflow

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.7.2

2.7.2

airflow

apache

< 2.7.2

2.7.2

Description

NVD description

More vulnerabilities in apache-airflow

See all →