Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Airflow 2.8.1 Clear all filters
TI-2023-27837 CVE-2023-50944 · GHSA-vm5m-qmrx-fw8w

Apache Airflow: Bypass permission verification to read code of other dags

Priority LOW 31

Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00979 Published 2024-01-24 Fixed in 2.8.1, 2.8.1rc1 CWE-862
TI-2023-27836 CVE-2023-50943 · GHSA-c3c6-f2ww-xfr2

Apache Airflow: Potential pickle deserialization vulnerability in XComs

Priority MEDIUM 41

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0122 Published 2024-01-24 Fixed in 2.8.1, 2.8.1rc1 CWE-502