CVE-2023-39508 json
Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges
published 2023-08-05 3 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2023-39508 , EUVD-2023-0014 , GHSA-269x-pg5c-5xgm , PYSEC-2023-134
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0
This issue affects Apache Airflow: before 2.6.0.
Patch / fix
- pypi apache-airflow 2.6.0, 2.6.0b1
- bitnami airflow 2.6.0
- Apache Software Foundation Apache Airflow 2.6.0
- apache airflow 2.6.0
- github.com/apache/airflow@101d59c commit
- github.com/apache/airflow#29706 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
2.63% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.6.0b1 <2.6.0 |
2.6.0b1 2.6.0 |
| bitnami | airflow | <2.6.0 |
2.6.0 |
Affected products
- Apache Software Foundation Apache Airflow
- apache airflow
Classification
References
-
github.com
/apache/airflow/pull/29706
patch, web, vendor-advisory, advisory
-
github.com
/apache/airflow/commit/101d59c4b88ab979d305b8d96f612c27c8a44aa8
web
-
lists.apache.org
/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15
vendor-advisory, web, mailing-list, advisory
-
seclists.org
/fulldisclosure/2023/Jul/43
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2023-39508
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-134.yaml
web
-
github.com
/advisories/GHSA-269x-pg5c-5xgm
advisory
Sources
- CVE List CVE-2023-39508
- GitHub Advisory GHSA-269x-pg5c-5xgm
- NVD CVE-2023-39508
- OSV BIT-airflow-2023-39508
- OSV PYSEC-2023-134
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.