CVE-2023-42781
Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
CVE-2023-42781- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
CVE-2023-42781- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-0026
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
EUVD-2023-0026- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r7x6-xfcm-3mxv
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
GHSA-r7x6-xfcm-3mxv- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-r7x6-xfcm-3mxv
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
GHSA-r7x6-xfcm-3mxv- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVBIT-airflow-2023-42781 No score
Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
BIT-airflow-2023-42781- Updated
- 2026-11-02
OSV No score
Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
CVE-2023-42781- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2023-231 No score
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
- Record
PYSEC-2023-231- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2023-42781 No score
CVE-2023-42781 in rootio-apache-airflow - Patched by Root
Root has patched CVE-2023-42781 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2023-42781- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflowPyPI |
before 2.7.3 | 2.7.3 |
airflowBitnami |
before 2.7.3 | 2.7.3 |
apache-airflowPyPI |
before 2.7.3, plus listed versions 1.10.01.10.11.10.101.10.10rc11.10.10rc2 Show 45 moreShow less1.10.10rc31.10.10rc41.10.10rc51.10.111.10.11rc11.10.11rc21.10.121.10.12rc11.10.12rc21.10.12rc31.10.12rc41.10.131.10.13rc11.10.141.10.14rc11.10.14rc21.10.14rc31.10.14rc41.10.151.10.15rc11.10.1b11.10.1rc21.10.21.10.2b21.10.2rc11.10.2rc21.10.2rc31.10.31.10.3b11.10.3b21.10.3rc11.10.3rc21.10.41.10.4b21.10.4rc11.10.4rc21.10.4rc31.10.4rc41.10.4rc51.10.51.10.5rc11.10.61.10.6rc11.10.6rc21.10.7 |
2.7.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-42781 is a medium vulnerability (CVSS 6.5) in Apache Airflow, published November 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in apache-airflow 2.7.3.
References
github.com/apache/airflow/pull/34939
lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1
openwall.com/lists/oss-security/2023/11/12/2
nvd.nist.gov/vuln/detail/CVE-2023-42781
Left out here: 117 versions. The JSON record has them.