CVE-2023-41891

    Dashboard / Vulnerabilities / CVE-2023-41891

    CVE-2023-41891

    Published: 30 Oct 2023Last Modified: 28 Oct 2026

    Summary: FlyteAdmin SQL Injection in List Filters

    Details: FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

    References: https://owasp.org/www-community/attacks/SQL_Injection#, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41891.json, https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4, https://nvd.nist.gov/vuln/detail/CVE-2023-41891, https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1df2d185d18df03ba3004b5c12171ef1229961a0

    Affected versions

    v1.1.123
    v1.1.122
    v1.1.121
    v1.1.120
    v1.1.119
    v1.1.118
    v1.1.115
    v1.1.117
    v1.1.116
    v1.1.114
    v1.1.113
    v1.1.112
    v1.1.105
    v1.1.111
    v1.1.110
    v1.1.109
    v1.1.108
    v1.1.107
    v1.1.106
    v1.1.104
    v1.1.103
    v1.1.102
    v1.1.101
    v1.1.100
    v1.1.99
    v1.1.98
    v1.1.97
    v1.1.96
    v1.1.95
    v1.1.94
    v1.1.93
    v1.1.88
    v1.1.92
    v1.1.91
    v1.1.90
    v1.1.89
    v1.1.87
    v1.1.86
    v1.1.85
    v1.1.84
    v1.1.83
    v1.1.82
    v1.1.81
    v1.1.80
    v1.1.79
    v1.1.78
    v1.1.77
    v1.1.76
    v1.1.75
    v1.1.74
    v1.1.73
    v1.1.72
    v1.1.71
    v1.1.70
    v1.1.69
    v1.1.68
    v1.1.67
    v1.1.66
    v1.1.65
    v1.1.64
    v1.1.63
    v1.1.62
    v1.1.61
    v1.1.60
    v1.1.59
    v1.1.58
    v1.1.57
    v1.1.56
    v1.1.55
    v1.1.54
    v1.1.53
    v1.1.52
    v1.1.48
    v1.1.51
    v1.1.50
    v1.1.49
    v1.1.19
    v1.1.47
    v1.1.46
    v1.1.45
    v1.1.44
    v1.1.43
    v1.1.42
    v1.1.41
    v1.1.40
    v1.1.39
    v1.1.38
    v1.1.37
    v1.1.36
    v1.1.35
    v1.1.34
    v1.1.33
    v1.1.32
    v1.1.31
    v1.1.30
    v1.1.29
    v1.1.28
    v1.1.27
    v1.1.26
    v1.1.23
    v1.1.25
    v1.1.24
    v1.1.22
    v1.1.21
    v1.1.20
    v1.1.18
    v1.1.17
    v1.1.16
    v1.1.15
    v1.1.14
    v1.1.13
    v1.1.12
    v1.1.11
    v1.1.10
    v1.1.9
    v1.1.8
    v1.1.7
    v1.1.6
    v1.1.5
    v1.1.4
    v1.1.3
    v1.1.2
    v1.1.1
    v1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-41891 | CVE-DB