Apache · Apache Airflow · CVE-2024-28746
**Name of the Vulnerable Software and Affected Versions**
Apache Airflow versions 2.8.0 through 2.8.2
**Description**
The issue is related to insufficient access control in Apache Airflow, allowing an authenticated user with limited permissions to access resources such as variables, connections, etc. from the UI, which they do not have permission to access. This could potentially allow a remote attacker to gain unauthorized access to resources.
**Recommendations**
For Apache Airflow versions 2.8.0 through 2.8.2, upgrade to version 2.8.3 or newer to mitigate the risk associated with this issue.