CVE-2023-49920

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected

• CWE-352

• http://www.openwall.com/lists/oss-security/2023/12/21/3Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/36026Patch
• https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjqMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/12/21/3Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/36026Patch
• https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjqMailing List, Third Party Advisory

Published

Dec 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4991A vulnerability was found in NextBX QWAlerter 4.50. It has b…7.8
• CVE-2023-49910A stack-based buffer overflow vulnerability exists in the we…8.8
• CVE-2023-49911A stack-based buffer overflow vulnerability exists in the we…8.8
• CVE-2023-49912A stack-based buffer overflow vulnerability exists in the we…8.8
• CVE-2023-49913A stack-based buffer overflow vulnerability exists in the we…8.8
• CVE-2023-49914InteraXon Muse 2 devices allow remote attackers to cause a d…6.5
• CVE-2023-49921An issue was discovered by Elastic whereby Watcher search in…6.5
• CVE-2023-49922An issue was discovered by Elastic whereby Beats and Elastic…6.5
• CVE-2023-49923 An issue was discovered by Elastic whereby the Documents AP…6.5
• CVE-2023-49926app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 a…6.1
• CVE-2023-49927An issue was discovered in Samsung Mobile Processor, Wearabl…5.3
• CVE-2023-49928An issue was discovered in Samsung Mobile Processor, Wearabl…7.5