PYSEC-2023-171

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

PYSEC-2023-170

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...

CVE-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

CVE-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

CVE-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

CVE-2023-40712

CVE-2023-40712 affects Apache Airflow prior to 2.7.1. Authenticated users with UI access can craft a URL to view task/dag details, potentially unmasking secret task configuration that is normally masked in the UI. Impact is information exposure with high confidentiality impact as per the CVE; no ...

CVE-2023-40611 Apache Airflow Dag Runs Broken Access Control Vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...

CVE-2023-40611

Apache Airflow vulnerable before 2.7.1: authenticated DAG-view users can modify DAG run detail values when submitting notes (e.g., configuration, start date). Root cause relates to broken access control around DAG runs. A fix exists in 2.7.1 and later; upgrade to 2.7.1+ to remove the vulnerabilit...

CVE-2023-40611 Apache Airflow Dag Runs Broken Access Control Vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...

CVE-2023-40611 Apache Airflow Dag Runs Broken Access Control Vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

Apache Airflow 信息泄露漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

PT-2023-8623 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions before 2.7.1 Description: The issue allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start...

PT-2023-8625 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.7.1 Description: The issue allows authenticated users who have access to see the task/dag in the UI to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be...

Apache Airflow Installed (Windows)

Binary data apacheairflowwininstalled.nbin...

The software for creating, monitoring, and orchestrating data processing scenarios in Airflow is vulnerable due to insufficient validation of input data. This vulnerability allows attackers to trigger service failures.

The software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is vulnerable due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in its lack of name-based path restrictions. This allows attackers to gain access to confidential information.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to deficiencies in path name restrictions. Exploiting this vulnerability can allow attackers to access confidential information using the runid parameter...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the lack of a mechanism for capturing session recordings. This allows attackers to intercept user sessions.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the lack of a mechanism for capturing sessions. Exploiting this vulnerability allows an attacker who operates remotely to intercept a user’s session...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the insufficient checking of incoming requests. This allows attackers to disclose sensitive information or cause service failures.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow a malicious actor to expose sensitive information or cause service failures by...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow, related to the disclosure of protected information, allows attackers to gain unauthorized access to protected information.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the exposure of protected information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected...