PT-2023-6909

CVE-2023-42781

Published

2023-11-12

Updated

2026-02-20

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.3

Description The issue is related to insufficient protection of internal data in Apache Airflow, allowing an authorized user with limited access to read specific DAGs to also read information about task instances in other DAGs. This can lead to unauthorized access to protected information.

Recommendations For Apache Airflow versions prior to 2.7.3, upgrade to version 2.7.3 or newer to mitigate the risk associated with this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2023-42781