CVE-2023-47037 Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

Medium 4.3 Published 12 Nov 2023 Updated 13 Feb 2025

Authenticated users with DAG-view permissions can improperly modify DAG run details due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-47037?

CVE-2023-47037 is a medium-severity missing authorization vulnerability in Apache Airflow, published on 12 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.

Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

Weakness: CWE-863

Which versions are affected by CVE-2023-47037?

4 open source packages ship an affected version, including apache-airflow and airflow. It affects 1 product.

Package	Affected	Fixed in
`apache-airflow` PyPI	All versions	`2.7.3`
`apache-airflow` PyPI	All versions	`2.7.3`
`apache-airflow` PyPI	All versions	`2.7.3`
`airflow` Bitnami	All versions	`2.7.3`

Products include Apache Airflow.

How do I fix CVE-2023-47037?

Upgrade apache-airflow to 2.7.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-47037 being exploited?

There is no known exploitation of CVE-2023-47037 in the wild and no public exploit code.

All Apache Airflow vulnerabilities

Sources

Also known as BIT-airflow-2023-47037, GHSA-hm9r-7f84-25c9, PYSEC-2023-232.