CVE-2023-42792

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.2

Description The issue allows an authenticated user with limited access to some DAGs to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus enabling the user to clear DAGs they shouldn't. This is related to the disclosure of information in the error data area. Exploitation of the vulnerability may allow a remote attacker to impact data integrity.

Recommendations For Apache Airflow versions prior to 2.7.2, upgrade to version 2.7.2 or newer to mitigate the risk associated with this issue.