Sensitive Information Exposure in Apache Airflow
Summary
CVE-2023-42780: Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs. Affects apache-airflow versions < 2.7.2. Fixed in 2.7.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2023-42780 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, schedule, and monitor complex workflows as Directed Acyclic Graphs (DAGs). Airflow provides a web interface for managing and visualizing workflows, along with a command-line interface for interacting with the system. It is widely used in data engineering and data science pipelines to automate and monitor data workflows.
Vulnerability Detail
Apache Airflow versions prior to 2.7.2 are vulnerable to a sensitive information exposure issue. Authenticated users of Airflow can list warnings for all DAGs, even if they do not have permission to view those DAGs. This vulnerability exposes the dag_ids and stack traces of import errors for DAGs with import issues. An attacker with limited access to Airflow could exploit this vulnerability to gather sensitive information about the system's DAGs and potentially gain insights into the underlying infrastructure. The impact of this vulnerability depends on the sensitivity of the information contained in the DAGs and the potential misuse of the exposed stack traces.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
Conclusion
Apache Airflow versions prior to 2.7.2 are vulnerable to a sensitive information exposure issue that allows authenticated users to list warnings for all DAGs, even if they do not have permission to view them. Upgrading to version 2.7.2 or newer is recommended to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, schedule, and monitor complex workflows as Directed Acyclic Graphs (DAGs).
This vulnerability allows authenticated users to list warnings for all DAGs, even if they do not have permission to view those DAGs. It exposes the dag_ids and stack traces of import errors for DAGs with import issues, potentially revealing sensitive information and infrastructure details.
To fix this vulnerability, upgrade your Apache Airflow installation to version 2.7.2 or newer. The latest version includes a patch that addresses the sensitive information exposure issue.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
No, this vulnerability requires authentication to the Apache Airflow system. An attacker would need valid credentials to exploit the sensitive information exposure issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
