CVE-2023-50944

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	< 2.8.1

References

http://www.openwall.com/lists/oss-security/2024/01/24/5Mailing List
https://github.com/apache/airflow/pull/36257Third Party Advisory
https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7hMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/01/24/5Mailing List
https://github.com/apache/airflow/pull/36257Third Party Advisory
https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7hMailing List, Vendor Advisory

Timeline

Published: Jan 24, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-509455.5IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user.CVE-2023-509466.5IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a brok CVE-2023-509475.4IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2023-509489.8IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its o CVE-2023-509498.1IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation. IBM X-Force ID CVE-2023-509505.3IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709.CVE-2023-509514.3IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some s CVE-2023-509525.4IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send CVE-2023-509534.3IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message CVE-2023-509545.3IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the sy CVE-2023-509552.7IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installati CVE-2023-509564.9IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials fr