CVE-2023-50783

CVE-2023-50783: Apache Airflow: Improper access control vulnerability on the "varimport" endpoint

Vendor Apache Software Foundation
Product Apache Airflow
Weakness CWE-284
Published December 21, 2023
Last update February 13, 2025

CVSS base score

What the vulnerability does

Description

Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue

Key dates

Disclosure timeline

December 21, 2023 CVE published
February 13, 2025 Record updated