PT-2024-1305

CVE-2023-50944

Published

2024-01-24

Updated

2026-02-20

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.8.1

Description The issue is related to a lack of authorization in Apache Airflow, allowing an authenticated user to access the source code of a DAG they do not have access to. This issue is considered low severity as it requires an authenticated user to exploit it.

Recommendations For Apache Airflow versions prior to 2.8.1, upgrade to version 2.8.1 to fix the issue. As a temporary workaround, consider restricting access to sensitive DAGs until the upgrade is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers

CVE-2023-50944

BDU:2024-00753