PT-2023-8623 · Apache · Apache Airflow

Happyhacking · Published 2023-09-12 · Updated 2026-02-20 · CVE-2023-40611

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions before 2.7.1

Description The issue allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start dates.

Recommendations For Apache Airflow versions before 2.7.1, users should upgrade to version 2.7.1 or later, which has removed the vulnerability.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-01276

BIT-AIRFLOW-2023-40611

CVE-2023-40611

GHSA-WPG8-MF6H-GM92

PYSEC-2023-170

Affected Products

Apache Airflow

References · 23

• https://osv.dev/vulnerability/PYSEC-2023-170 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01276 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40611 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-40611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40611 · Security Note
• https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wpg8-mf6h-gm92 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2023-40611 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/pull/33413 · Vendor Advisory, Patch
• https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad · Note
• https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-170.yaml · Note
• https://t.me/cvenotify/126628 · Telegram Post
• https://t.me/cvenotify/67545 · Telegram Post