CVE-2023-35908

CVE-2023-35908: Apache Airflow: Access to DAGs without relevant permission

Vendor Apache Software Foundation

Product Apache Airflow

Weakness CWE-863 · Incorrect authorization

Published July 12, 2023

Last update October 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected

Key dates

02Disclosure timeline

July 12, 2023 CVE published

October 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-35908 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html AskarLabs — CWE-863 write-up Incorrect Authorization

Related vulnerabilities

04Related CVE

CVE-2026-3525 File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020 CVE-2024-13302 Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068 CVE-2025-15525 Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure CVE-2025-13753 WP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation CVE-2025-12082 CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112