CVE-2023-50783: Apache Airflow: Improper access control vulnerability on the "varimport" endpoint

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-21 · updated 2026-06-17
Weakness: CWE-284

Description

Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue

Affected products

Apache Airflow: before 2.8.0 — fixed in 2.8.0

How to fix

Upgrade to a fixed version: Apache Airflow 2.8.0. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2023/12/21/4
https://github.com/apache/airflow/pull/33932
https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn
http://www.openwall.com/lists/oss-security/2023/12/21/4
https://github.com/apache/airflow/pull/33932
https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn

Get alerted when CVE-2023-50783 or the next vulnerability affects your stack