{"cve":"CVE-2023-37379","nvd":{"published":"2023-08-23T16:15:09.330","modified":"2026-06-17T06:08:07.257","status":"Modified","description":"Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server.\n\nUsers of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","score":8.1},"cwes":["CWE-200","CWE-400","CWE-918"],"references":["http://www.openwall.com/lists/oss-security/2023/08/23/4","https://github.com/apache/airflow/pull/32052","https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r","http://www.openwall.com/lists/oss-security/2023/08/23/4","https://github.com/apache/airflow/pull/32052"],"products":["apache:airflow"],"source":"nvd","synced_at":"2026-10-19T21:39:14.809778102+00:00"},"epss":{"cve":"CVE-2023-37379","score":0.01957,"percentile":0.80291,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-x2mh-8fmc-rqgh","url":"https://osv.dev/vulnerability/GHSA-x2mh-8fmc-rqgh","summary":"Apache Airflow denial of service vulnerability","modified":"2025-02-13T19:33:23.566110Z","packages":[{"ecosystem":"PyPI","name":"apache-airflow","purl":"pkg:pypi/apache-airflow","ranges":["<2.7.0b1"],"fixed":["2.7.0b1"]}]},{"id":"PYSEC-2023-152","url":"https://osv.dev/vulnerability/PYSEC-2023-152","summary":"","modified":"2026-06-10T17:00:22.111008488Z","packages":[{"ecosystem":"PyPI","name":"apache-airflow","purl":"pkg:pypi/apache-airflow","ranges":["<2.7.0"],"fixed":["2.7.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}