CVE-2023-37379

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.

• CWE-200
• CWE-400
• CWE-918

• http://www.openwall.com/lists/oss-security/2023/08/23/4Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/32052Patch
• https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571rVendor Advisory
• http://www.openwall.com/lists/oss-security/2023/08/23/4Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/32052Patch
• https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571rVendor Advisory

Published

Aug 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37373A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…7.5
• CVE-2023-37374A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-37375A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-37376A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-37377An issue was discovered in Samsung Exynos Mobile Processor a…7.5
• CVE-2023-37378Nullsoft Scriptable Install System (NSIS) before 3.09 mishan…5.3
• CVE-2023-3738Inappropriate implementation in Autofill in Google Chrome pr…4.3
• CVE-2023-37385Improper Limitation of a Pathname to a Restricted Directory …7.3
• CVE-2023-37386Cross-Site Request Forgery (CSRF) vulnerability in Media Lib…8.8
• CVE-2023-37387Cross-Site Request Forgery (CSRF) vulnerability in RadiusThe…8.8
• CVE-2023-37388Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-37389Improper Privilege Management vulnerability in SAASPROJECT B…8.8