CVE-2023-42781

Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.  This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.

• CWE-200

• http://www.openwall.com/lists/oss-security/2023/11/12/2Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/34939Patch
• https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/11/12/2Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/34939Patch
• https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1Mailing List, Third Party Advisory

Published

Nov 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42773Improper neutralization in Intel(R) Power Gadget software fo…7.8
• CVE-2023-42774in OpenHarmony v3.2.2 and prior versions allow a local attac…5.5
• CVE-2023-42775Rejected reason: This is unused.
• CVE-2023-42776Improper input validation in some Intel(R) SGX DCAP software…5.5
• CVE-2023-4278The MasterStudy LMS WordPress Plugin WordPress plugin before…7.5
• CVE-2023-42780Apache Airflow, versions prior to 2.7.2, contains a security…6.5
• CVE-2023-42782A insufficient verification of data authenticity vulnerabili…5.3
• CVE-2023-42783A relative path traversal in Fortinet FortiWLM version 8.6.0…7.5
• CVE-2023-42784An improper handling of syntactically invalid structure in F…9.8
• CVE-2023-42785A null pointer dereference in FortiOS versions 7.4.0 through…6.5
• CVE-2023-42786A null pointer dereference in FortiOS versions 7.4.0 through…6.5
• CVE-2023-42787A client-side enforcement of server-side security [CWE-602] …6.5