CVE-2023-41891

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
flyteorg	flyteadmin	< 1.1.124

References

https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fdPatch, Third Party Advisory
https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4Third Party Advisory
https://owasp.org/www-community/attacks/SQL_Injection#Third Party Advisory
https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fdPatch, Third Party Advisory
https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4Third Party Advisory
https://owasp.org/www-community/attacks/SQL_Injection#Third Party Advisory

Timeline

Published: Oct 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-418929.8Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installat CVE-2023-418935.4Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable CVE-2023-418945.3Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable v CVE-2023-418959.6Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials a CVE-2023-418969.0Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_cal CVE-2023-418979.6Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Option CVE-2023-418987.8Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbit CVE-2023-418997.2Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Reque CVE-2023-41906.5Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.CVE-2023-419004.3Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authenticat CVE-2023-419027.8An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by CVE-2023-419045.4Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.