CVE Feed

    Dashboard / CVE / CVE-2023-50783

    CVE-2023-50783

    Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue

    Published:Dec 21, 2023
    Last Modified:Feb 13, 2025
    EPS:Dec 21, 2023
    EPSS Score:0.00028
    CVSS Score:6.5

    Affected Products

    Vendor
    Apache
    Product
    Airflow

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-59244 (CVSS 6.5) — Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered …
    CVE-2026-58076 (CVSS 8.8) — Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam…
    CVE-2026-59242 (CVSS 5.4) — Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal …
    CVE-2026-54183 (CVSS 4.3) — Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U…
    CVE-2026-67260 (CVSS 7.3) — Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe…
    CVE-2026-67587 (CVSS 8.8) — Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic…
    CVE-2026-65017 (CVSS 6.5) — Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.…
    CVE-2026-68968 (CVSS 7.5) — Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf…
    CVE-2026-68969 (CVSS 6.5) — Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w…
    CVE-2026-68970 (CVSS 6.5) — Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High