CVE-2023-42663

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	< 2.7.2

References

http://www.openwall.com/lists/oss-security/2023/11/12/2Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/34315Patch
https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/11/12/2Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/34315Patch
https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9Mailing List, Vendor Advisory

Timeline

Published: Oct 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-426647.2A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit V CVE-2023-426665.3The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attack CVE-2023-426677.8Improper isolation in the Intel(R) Core(TM) Ultra Processor stream cache mechanism may allow an authenticated user to potentially enable esc CVE-2023-426686.7Incorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards based on Intel(R) 62X Chi CVE-2023-426696.5A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. Thi CVE-2023-426706.5A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disrupti CVE-2023-426715.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426725.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426735.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426745.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426755.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426765.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc