CVE-2023-49920

Summary

CVE-2023-49920 is a vulnerability affecting Apache Airflow versions 2.7.0 through 2.7.3. An attacker can exploit this issue by triggering a DAG in a GET request without proper CSRF validation. This means that a malicious website, opened in the same browser as the Airflow UI, can execute DAGs without the user's consent. To mitigate this risk, users are advised to upgrade to Airflow version 2.8.0 or later, which is not affected by this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.