Cyber Resilience

CVE-2023-48291

Apache Airflow ≤ 2.8.0

Published
21 December 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.018 76th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2023-48291 is a medium-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Apache Airflow. Its CVSS base score is 4.3 (Medium).

Operationally, ranked in the top 24% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that…

more

the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.

CWE(s)

Related Threats

CVEs Like This One

CVE-2026-28779Same product: Apache Airflow
CVE-2026-32690Same product: Apache Airflow
CVE-2023-42792Same product: Apache Airflow
CVE-2026-34538Same product: Apache Airflow
CVE-2026-30912Same product: Apache Airflow
CVE-2023-22888Same product: Apache Airflow
CVE-2026-32228Same product: Apache Airflow
CVE-2025-68438Same product: Apache Airflow
CVE-2026-31987Same product: Apache Airflow
CVE-2026-48828Same product: Apache Airflow

Affected Assets

apache
airflow
≤ 2.8.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-668

Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.

addresses: CWE-668

The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.

addresses: CWE-668

The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.

addresses: CWE-668

Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.

addresses: CWE-668

Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.

addresses: CWE-668

Controlling internal connections prevents exposure of resources to unintended internal spheres.

addresses: CWE-668

Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.

addresses: CWE-668

The control prevents exposure of the media resource to the wrong security sphere.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing least-privilege authorizations directly prevents resources from being exposed outside their intended control sphere.

PR.IR-01 partial match
prevents

Network segmentation and unauthorized-access protections reduce the chance of resources being reachable by the wrong sphere.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.

none

Requiring owners to manage the full asset life cycle and remove assets from the inventory upon secure disposal helps prevent resources from being inadvertently exposed outside their intended security sphere.

References