CVE-2023-42781 Apache Airflow: Permission verification bypass allows viewing dagruns of other dags

Medium 6.5 Published 12 Nov 2023 Updated 13 Feb 2025

Authorized users can bypass permission checks to view task instance information in DAGs they do not have access to.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-42781?

CVE-2023-42781 is a medium-severity missing authorization vulnerability in Apache Airflow, published on 12 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.

Weakness: CWE-200

Which versions are affected by CVE-2023-42781?

4 open source packages ship an affected version, including apache-airflow and airflow. It affects 1 product.

Package	Affected	Fixed in
`apache-airflow` PyPI	All versions	`2.7.3`
`apache-airflow` PyPI	All versions	`2.7.3`
`apache-airflow` PyPI	All versions	`2.7.3`
`airflow` Bitnami	All versions	`2.7.3`

Products include Apache Airflow.

How do I fix CVE-2023-42781?

Upgrade apache-airflow to 2.7.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-42781 being exploited?

There is no known exploitation of CVE-2023-42781 in the wild and no public exploit code.

All Apache Airflow vulnerabilities

Sources

Also known as BIT-airflow-2023-42781, GHSA-r7x6-xfcm-3mxv, PYSEC-2023-231.