CVE-2023-40611: Apache Airflow - Unauthorized Modification of DAG Run Details
Summary
CVE-2023-40611: Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. Affects apache-airflow versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2023-40611 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define and execute complex workflows as Directed Acyclic Graphs (DAGs). The platform provides a web-based user interface for managing and monitoring workflows. However, versions prior to 2.7.1 are affected by a vulnerability that allows authenticated and DAG-view authorized users to modify certain DAG run detail values when submitting notes. This vulnerability enables unauthorized alteration of configuration parameters, start dates, and other critical details.
Vulnerability Detail
The vulnerability in Apache Airflow allows authenticated users with DAG-view authorization to manipulate DAG run details by submitting notes. This can lead to unauthorized modification of configuration parameters, start dates, and other important details associated with DAG runs. The vulnerability poses a risk of unauthorized access and potential disruption of workflows. It is important to upgrade to version 2.7.1 or later to mitigate this vulnerability.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Apache Airflow versions prior to 2.7.1 are vulnerable to unauthorized modification of DAG run details. This can lead to unauthorized access and disruption of workflows. It is crucial to upgrade to version 2.7.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows.
The vulnerability allows authenticated users with DAG-view authorization to modify critical DAG run details, potentially leading to unauthorized access and disruption of workflows.
To mitigate this vulnerability, upgrade to Apache Airflow version 2.7.1 or later, as it includes a fix that removes the vulnerability.
No specific workarounds have been provided for this vulnerability. It is recommended to upgrade to the fixed version.
For more information about this vulnerability, refer to the official advisory provided by the Apache Airflow project.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
