CVE-2023-41891

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

• CWE-89

• https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fdPatch, Third Party Advisory
• https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4Third Party Advisory
• https://owasp.org/www-community/attacks/SQL_Injection#Third Party Advisory
• https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fdPatch, Third Party Advisory
• https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4Third Party Advisory
• https://owasp.org/www-community/attacks/SQL_Injection#Third Party Advisory

Published

Oct 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41886OpenRefine is a powerful free, open source tool for working …7.5
• CVE-2023-41887OpenRefine is a powerful free, open source tool for working …9.8
• CVE-2023-41888GLPI stands for Gestionnaire Libre de Parc Informatique is a…5.4
• CVE-2023-41889SHIRASAGI is a Content Management System. Prior to version 1…5.3
• CVE-2023-4189Cross-site Scripting (XSS) - Reflected in GitHub repository …4.8
• CVE-2023-41890Sustainsys.Saml2 library adds SAML2P support to ASP.NET web …7.5
• CVE-2023-41892Craft CMS is a platform for creating digital experiences. Th…9.8
• CVE-2023-41893Home assistant is an open source home automation. The audit …5.4
• CVE-2023-41894Home assistant is an open source home automation. The assess…5.3
• CVE-2023-41895Home assistant is an open source home automation. The Home A…9.6
• CVE-2023-41896Home assistant is an open source home automation. Whilst aud…9
• CVE-2023-41897Home assistant is an open source home automation. Home Assis…9.6