PT-2023-4783 · Apache · Apache Airflow

Balis0Ng · CVE-2023-39508 · Published 2023-08-04 · Updated 2026-02-20

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.0

Description The issue is related to the "Run Task" feature in Apache Airflow, which allows an authenticated user to bypass some restrictions and execute code in the webserver context, as well as access certain DAGs beyond their limitations. This feature is considered dangerous and has been removed entirely in Airflow 2.6.0. The vulnerability can lead to exposure of sensitive information to unauthorized actors.

Recommendations For Apache Airflow versions prior to 2.6.0, consider updating to version 2.6.0 or later, where the "Run Task" feature has been removed entirely. As a temporary workaround, consider disabling the "Run Task" feature to minimize the risk of exploitation. Restrict access to the webserver context and certain DAGs to prevent unauthorized access.

Exploit

Fix

DoS

Information Disclosure

Weakness Enumeration

CWE-250

CWE-200

Related Identifiers

BDU:2023-05231

BIT-AIRFLOW-2023-39508

CVE-2023-39508

GHSA-269X-PG5C-5XGM

PYSEC-2023-134

Affected Products

Apache Airflow

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39508.json · Exploit
• https://bdu.fstec.ru/vul/2023-05231 · Security Note
• https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39508 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2023-39508 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-269x-pg5c-5xgm · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-39508 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-134 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39508 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/pull/29706 · Patch, Vendor Advisory
• https://github.com/apache/airflow/commit/101d59c4b88ab979d305b8d96f612c27c8a44aa8 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-134.yaml · Note
• https://t.me/cvenotify/56114 · Telegram Post
• https://t.me/cibsecurity/67813 · Telegram Post