CVE-2023-51232: Dagster Path Traversal Vulnerability in /logs Endpoint
Summary
CVE-2023-51232: Dagster vulnerable to Path Traversal attack through its /logs endpoint. Affects dagster versions < 1.5.11. Fixed in 1.5.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dagster is an open-source data orchestrator designed to develop, produce, and observe data workflows. It provides a robust framework for managing complex data pipelines, enabling users to build, schedule, and monitor data processing tasks. However, versions of Dagster prior to 1.5.11 are susceptible to a directory traversal vulnerability that could expose sensitive information.
Vulnerability Detail
The vulnerability arises from improper validation of user input in the /logs endpoint of the Dagster webserver. Attackers can exploit this flaw by sending crafted requests that may allow them to access sensitive files on the server, particularly those with names starting with a dot ('.'). This could lead to unauthorized information disclosure, potentially compromising the confidentiality of sensitive data stored on the server.
How To Fix
Latest published version: 1.13.26 as of 22 Oct 2026
pip install --upgrade "dagster==1.13.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.11
This is the first release that contains the fix.
pip install --upgrade "dagster==1.5.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the /logs endpoint or implement additional input validation to prevent unauthorized file access. However, the best solution is to upgrade to the patched version.
Conclusion
In summary, CVE-2023-51232 is a significant vulnerability in Dagster that can lead to unauthorized access to sensitive files. Users are strongly advised to upgrade to version 1.5.11 or later to mitigate this risk. For those unable to upgrade immediately, implementing temporary workarounds can help reduce exposure.
See every vulnerability recorded for dagster →
FAQ
CVE-2023-51232 is a directory traversal vulnerability found in the Dagster webserver that allows attackers to access sensitive files through crafted requests.
All versions of Dagster prior to 1.5.11 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information, which may compromise the security and privacy of the data managed by Dagster.
Yes, you can implement additional input validation or restrict access to the /logs endpoint as a temporary workaround until you can upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for dagster.
