CVE-2023-35908 Apache Airflow: Access to DAGs without relevant permission

2023-07-1209:14:10

CWE-863

apache

www.cve.org

apache airflow

vulnerability

unauthorized access

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

41.2%

JSON

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.6.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]