Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8ykk-1kak-6bfd
Vulnerability ID VCID-8ykk-1kak-6bfd
Aliases CVE-2023-42780
GHSA-cgx2-rrmr-jx43
PYSEC-2023-202
Summary Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2023-42780
cvssv3.1 6.5 https://github.com/apache/airflow/pull/34355
cvssv3.1 6.5 https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-42780
https://github.com/apache/airflow/pull/34355
https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d
CVE-2023-42780 https://nvd.nist.gov/vuln/detail/CVE-2023-42780
GHSA-cgx2-rrmr-jx43 https://github.com/advisories/GHSA-cgx2-rrmr-jx43
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow/pull/34355
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.32066
EPSS Score 0.0013
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:32:53.899679+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2023-202.yaml 38.6.0