High severity · published Aug 5, 2023
CVE-2023-39508
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task"…
8.8
CVSS
2.6%
EPSS
No
On KEV
Description
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0
This issue affects Apache Airflow: before 2.6.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Airflow · Apache
before 2.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39508
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39508
Not Applicable
http://seclists.org/fulldisclosure/2023/Jul/43
Patch
https://github.com/apache/airflow/pull/29706
Mailing List
https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15
More from Airflow
9.8
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
8.8
CVE-2020-11978
Apache Airflow Command Injection
9.8
CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
9.8
CVE-2023-25754
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0
9.8
CVE-2023-22884
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache…