CVE-2023-39508

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0

This issue affects Apache Airflow: before 2.6.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200 CWE-250

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	< 2.6.0
apache	airflow	< 2.6.0

References

http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
https://github.com/apache/airflow/pull/29706Patch, Vendor Advisory
https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15Mailing List, Vendor Advisory
http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
https://github.com/apache/airflow/pull/29706Patch, Vendor Advisory
https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15Mailing List, Vendor Advisory

Timeline

Published: Aug 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-395097.2A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary c CVE-2023-395104.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395114.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395124.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395135.4Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395145.4Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395154.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395164.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395175.4Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clic CVE-2023-395185.4social-media-skeleton is an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Versions 1.0.0 until 1 CVE-2023-395194.9Cloud Explorer Lite is an open source cloud management platform. Prior to version 1.4.0, there is a risk of sensitive information leakage in CVE-2023-395207.8Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 all