What’s Vulnerable › Vulnerabilities

CVE-2023-47037: Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-12 · updated 2026-06-17
• Weakness: CWE-863

Description

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.  Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.  Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

Affected products

• Apache Airflow: before 2.7.3 — fixed in 2.7.3

How to fix

Upgrade to a fixed version: Apache Airflow 2.7.3. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2023/11/12/1
• https://github.com/apache/airflow/pull/33413
• https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0
• http://www.openwall.com/lists/oss-security/2023/11/12/1
• https://github.com/apache/airflow/pull/33413
• https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0

Get alerted when CVE-2023-47037 or the next vulnerability affects your stack