CVE-2023-39508

High

Description

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0 This issue affects Apache Airflow: before 2.6.0.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Apache Airflow

PublishedAug 5, 2023

First seenAug 5, 2023

Weakness typeCWE-250CWE-250 CWE-200Sensitive information exposure

How to fix

Update

apache airflow2.6.0 or later
apache-airflow2.6.0b1, 2.6.0 or later

Patches

github.com/apache/airflow/pull/29706

Vendor advisories

lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15

Affected products

Product	Affected versions	Fixed in
apache airflow	v < 2.6.0	2.6.0
apache-airflowPyPI	v < 2.6.0b1, v < 2.6.0	2.6.0b1, 2.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.