PT-2023-4014 · Apache · Apache Airflow

Karthikeyan Singaravelan · Published 2023-07-11 · Updated 2026-02-20 · CVE-2023-35908

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.3

Description The issue is related to improper authorization in Apache Airflow, allowing unauthorized read access to a DAG through a specially crafted URL. This could enable a remote attacker to disclose protected information.

Recommendations For versions prior to 2.6.3, upgrade to a version that is not affected to resolve the issue. As a temporary workaround, consider restricting access to the DAGs through the URL to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2023-04312

BIT-AIRFLOW-2023-35908

CVE-2023-35908

GHSA-2H84-3CRQ-VGFJ

PYSEC-2023-119

Affected Products

Apache Airflow

References · 16

• https://github.com/apache/airflow/pull/32014 · Patch
• https://osv.dev/vulnerability/GHSA-2h84-3crq-vgfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35908 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2023-35908 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-35908 · Vendor Advisory
• https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04312 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-119 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35908 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/ac65b82eeeeaa670e09a83c7da65cbac7e89f8db · Note
• https://github.com/apache/airflow/commit/c78e16588ee399f6eaf60425eb1ad7fa6d3fe352 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-119.yaml · Note
• https://t.me/cibsecurity/66530 · Telegram Post
• https://t.me/cvenotify/54773 · Telegram Post