Apache Airflow vulnerable to sensitive information exposure

MEDIO 6.5CVE-2023-42663 · BIT-airflow-2023-42663 · GHSA-32wr-qqw6-5mfp · Published 14/10/2023 · updated 17/06/2026

En resumen

CVE-2023-42663 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a apache-airflow, airflow (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.0%, mayor que el 80.9% de las vulnerabilidades.
Solución: actualizar a 2.7.2 o posterior.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.7.2`	`2.7.2`
airflow apache	`< 2.7.2`	`2.7.2`

Description

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user with access to read specific DAGs only to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

NVD description

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2023-42663 · ADVISORY
apache/airflow#34315 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9 · WEB
openwall.com/lists/oss-security/2023/11/12/2 · WEB
GitHub Advisory GHSA-32wr-qqw6-5mfp · ADVISORY

Más vulnerabilidades de apache-airflow

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.7.2

2.7.2

airflow

apache

< 2.7.2

2.7.2

Description

NVD description

Más vulnerabilidades de apache-airflow

Ver todo →