Read the docs
TI-2023-20640 Aliases CVE-2023-39508GHSA-269x-pg5c-5xgm

Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges

Priority MEDIUM 45CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-250.

Summary

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0 This issue affects Apache Airflow: before 2.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0263 85th percentileScored 2026-11-07
Fix Fixed Apache Airflow (Apache Software Foundation): 2.6.0apache-airflow (PyPI): 2.6.0b1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflowbefore 2.6.02.6.0Patch availableCNA
—apache-airflow (PyPI)before 2.6.0b12.6.0b1Patch availableGHSA-269x-pg5c-5xgm
  • Apache Airflow VendorApache Affected before 2.6.0 Fixed in 2.6.0 Patch available CNA
  • apache-airflow (PyPI) Vendor— Affected before 2.6.0b1 Fixed in 2.6.0b1 Patch available GHSA-269x-pg5c-5xgm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*before 2.6.0VulnerableApache
  • cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* Versions before 2.6.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow (Apache Software Foundation) Fixed in 2.6.0
  • Fix · GHSA-269x-pg5c-5xgm apache-airflow (PyPI) Fixed in 2.6.0b1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-39508
  2. 2026-10-03 Alias added: GHSA-269x-pg5c-5xgm

References

Patch 1

Advisory 2

Other 4

  • TI-2020-10905 Missing authentication in Apache Airflow KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-09638 OS command injection in Apache Airflow KEVCVSS 3.1HIGH 8.8
  • TI-2022-19017 Apache Airflow <2.4.0 has an RCE in a bash example CVSS 3.1HIGH 8.8
  • TI-2021-16140 Apache Airflow: Variable Import endpoint missed authentication check CVSS 3.1CRITICAL 9.8
  • TI-2022-08169 Apache Airflow: RCE in example DAGs CVSS 3.1HIGH 8.8
  • TI-2024-26776 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler CVSS 3.1HIGH 8.8
See all 157 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences