Every CVESearch/Get API key

CVE-2023-40611

Apache Airflow Dag Runs Broken Access Control Vulnerability

4.3 MediumFix available

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.74%Up 1.7 points since Sep 13, 2023
90%50%10%1%

What each source reports

NVD Score used4.3

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
CVE-2023-40611
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
CVE List4.3

Apache Airflow Dag Runs Broken Access Control Vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
CVE-2023-40611
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2023-00184.3

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
EUVD-2023-0018
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wpg8-mf6h-gm925.3

Apache Airflow Incorrect Authorization vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
GHSA-wpg8-mf6h-gm92
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV4.3

Apache Airflow Dag Runs Broken Access Control Vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
CVE-2023-40611
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVGHSA-wpg8-mf6h-gm925.3

Apache Airflow Incorrect Authorization vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
GHSA-wpg8-mf6h-gm92
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVBIT-airflow-2023-40611No score

Apache Airflow Dag Runs Broken Access Control Vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
BIT-airflow-2023-40611
Updated
2026-11-02
OSVPYSEC-2023-170No score

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Record
PYSEC-2023-170
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache-airflow
PyPI
before 2.7.1
2.7.1
airflow
Bitnami
before 2.7.3
2.7.3
apache-airflow
PyPI
before 2.7.1, plus listed versions
1.10.01.10.11.10.101.10.10rc11.10.10rc2
Show 45 moreShow less
1.10.10rc31.10.10rc41.10.10rc51.10.111.10.11rc11.10.11rc21.10.121.10.12rc11.10.12rc21.10.12rc31.10.12rc41.10.131.10.13rc11.10.141.10.14rc11.10.14rc21.10.14rc31.10.14rc41.10.151.10.15rc11.10.1b11.10.1rc21.10.21.10.2b21.10.2rc11.10.2rc21.10.2rc31.10.31.10.3b11.10.3b21.10.3rc11.10.3rc21.10.41.10.4b21.10.4rc11.10.4rc21.10.4rc31.10.4rc41.10.4rc51.10.51.10.5rc11.10.61.10.6rc11.10.6rc21.10.7
2.7.1

History

History
RecordedChangedSources
aliases, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-40611 is a medium vulnerability (CVSS 4.3) in Apache Airflow, published September 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 78th percentile. Fixed in apache-airflow 2.7.1.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 113 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open