-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the handling of the 'dag_id=~' parameter in the get_task_instances endpoint. In vulnerable versions (<2.7.3), when '~' was used as a wildcard, the query lacked proper authorization checks to limit results to DAGs the user could actually read. The patch adds a critical filter using get_readable_dags() in the else clause, demonstrating the missing authorization check was the root cause. The test additions in test_task_instance_endpoint.py validate that the fix properly restricts results to authorized DAGs.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow | pip | < 2.7.3 | 2.7.3 |
Ongoing coverage of React2Shell