CVE-2023-25956
Apache Airflow AWS Provider: Arbitrary file read via AWS provider
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.
This issue affects Apache Airflow AWS Provider versions before 7.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.
This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- Record
CVE-2023-25956- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
CVE List
Apache Airflow AWS Provider: Arbitrary file read via AWS provider
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.
This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- Record
CVE-2023-25956- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2023-0810
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.
This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- Record
EUVD-2023-0810- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w695-p3j5-hrj9
Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- Record
GHSA-w695-p3j5-hrj9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
Apache Airflow AWS Provider: Arbitrary file read via AWS provider
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.
This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- Record
CVE-2023-25956- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-w695-p3j5-hrj9
Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- Record
GHSA-w695-p3j5-hrj9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVPYSEC-2026-771
Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- Record
PYSEC-2026-771- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2023-25956
CVE-2023-25956 in rootio-apache-airflow-providers-amazon - Patched by Root
Root has patched CVE-2023-25956 in the rootio-apache-airflow-providers-amazon package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2023-25956- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflow-providers-amazonPyPI |
before 7.2.1 | 7.2.1 |
apache-airflow-providers-amazonPyPI |
before 7.2.1, plus listed versions 1.0.01.0.0b11.0.0b21.0.0rc11.1.0 Show 45 moreShow less1.1.0rc11.2.01.2.0rc11.3.01.3.0rc11.4.01.4.0rc12.0.02.0.0rc12.0.0rc22.1.02.1.0rc12.1.0rc22.2.02.2.0rc12.3.02.3.0rc12.3.0rc22.4.02.4.0rc12.4.0rc22.5.02.5.0rc12.6.02.6.0rc13.0.03.0.0rc13.0.0rc23.1.0rc13.1.13.1.1rc13.2.03.2.0rc13.3.03.3.0rc13.4.03.4.0rc14.0.04.0.0rc14.0.0rc24.1.04.1.0rc15.0.05.0.0rc15.0.0rc2 |
7.2.1 |
rootio-apache-airflow-providers-amazonRoot:PyPI |
before 4.0.0+root.io.1 | 4.0.0+root.io.14.0.0+root.io.24.0.0+root.io.3 |
apache-airflow-providers-amazonRoot:PyPI |
before 4.0.0+aikido.3 | 4.0.0+aikido.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-25956 is a high vulnerability (CVSS 7.5) in Apache Software Foundation Airflow Aws Provider, published February 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in apache-airflow-providers-amazon 7.2.1.
References
github.com/apache/airflow/pull/29587
lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv
nvd.nist.gov/vuln/detail/CVE-2023-25956
pypi.org/project/apache-airflow-providers-amazon
Left out here: 18 versions. The JSON record has them.