CVE-2023-40273 json
Session fixation in Apache Airflow web interface
published 2023-08-23 3 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2023-40273 , EUVD-2023-0017 , GHSA-pm87-24wq-r8w9 , PYSEC-2023-158
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).
With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.
Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.
Patch / fix
- pypi apache-airflow 2.7.0rc2, 2.7.1rc1
- bitnami airflow 2.7.1
- Apache Software Foundation Apache Airflow 2.7.0
- github.com/apache/airflow@2caa186 commit
- github.com/apache/airflow@f5d8201 commit
- github.com/apache/airflow#33347 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.85% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.7.0rc2 <2.7.1rc1 |
2.7.0rc2 2.7.1rc1 |
| bitnami | airflow | <2.7.1 |
2.7.1 |
Affected products
- Apache Software Foundation Apache Airflow
- apache airflow
Classification
- Weakness
-
- CWE-384 Session Fixation
References
-
github.com
/apache/airflow/pull/33347
patch, web, third-party-advisory, advisory
-
github.com
/apache/airflow/commit/2caa186935151683076b74357daad83d2538a3f6
web
-
github.com
/apache/airflow/commit/f5d8201ea7935d17cecaf25fc90d4ef0ccdd627b
web
-
lists.apache.org
/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj
vendor-advisory, web, advisory
-
openwall.com
/lists/oss-security/2023/08/23/1
web, mailing-list, third-party-advisory, advisory, article
-
nvd.nist.gov
/vuln/detail/CVE-2023-40273
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-158.yaml
web
-
github.com
/advisories/GHSA-pm87-24wq-r8w9
advisory
Sources
- CVE List CVE-2023-40273
- GitHub Advisory GHSA-pm87-24wq-r8w9
- NVD CVE-2023-40273
- OSV BIT-airflow-2023-40273
- OSV PYSEC-2023-158
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.