title: Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
description: Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.  This is a different issue than CVE-2023-42663 but leading to similar outcome.
Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: Apache Airflow
vendor: Apache Software Foundation
versions:
lessThan: 2.7.3, status: affected, version: 0, versionType: semver
}
metrics:
other: [
content: {'text': 'low'}
type: Textual description of severity
]