CVE-2023-40611: Apache Airflow - Unauthorized Modification of DAG Run Details
Summary
CVE-2023-40611: Apache Airflow Dag Runs Broken Access Control Vulnerability. Affects airflow versions < 2.7.3. Fixed in 2.7.3. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2023-40611 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define tasks and their dependencies as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure. Airflow provides a web-based user interface for managing and monitoring workflows. However, versions prior to 2.7.1 are affected by a vulnerability that allows authenticated and DAG-view authorized users to modify certain DAG run detail values when submitting notes. This vulnerability could enable unauthorized alteration of configuration parameters, start dates, and other important details.
Vulnerability Detail
The vulnerability in Apache Airflow (CVE-2023-40611) arises from a lack of proper authorization checks when handling user-submitted notes for DAG runs. Authenticated users with DAG-view authorization can exploit this flaw to modify critical details associated with DAG runs. By tampering with configuration parameters or start dates, an attacker could disrupt the intended workflow execution, leading to potential data integrity issues or unauthorized access to resources. This vulnerability poses a medium-level risk.
How To Fix
Minimum fixed version
2.7.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Apache Airflow versions prior to 2.7.1 are vulnerable to unauthorized modification of DAG run details. This could allow authenticated and DAG-view authorized users to tamper with critical parameters and disrupt workflow execution. To mitigate this vulnerability, users should upgrade to Apache Airflow version 2.7.1 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a web-based user interface for managing and monitoring workflows.
This vulnerability allows authenticated and DAG-view authorized users to modify certain DAG run detail values when submitting notes. It could lead to unauthorized alteration of configuration parameters, start dates, and other important details, potentially disrupting workflow execution and compromising data integrity.
Users of Apache Airflow versions prior to 2.7.1 are affected by this vulnerability.
To fix this vulnerability, users should upgrade their Apache Airflow installation to version 2.7.1 or later.
No workaround is available for this vulnerability. Upgrading to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
