id: PYSEC-2024-46
modified: 2024-03-14T11:19:09.515892Z
published: 2024-03-14T09:15:00Z
aliases:
- CVE-2024-28746
- GHSA-h574-6646-vfxx
details: |
  Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. 

  Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability
affected:
- package:
    ecosystem: PyPI
    name: apache-airflow
    purl: pkg:pypi/apache-airflow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 2.8.0
    - fixed: 2.8.3rc1
  versions:
  - 2.8.0
  - 2.8.1
  - 2.8.1rc1
  - 2.8.2
  - 2.8.2rc1
  - 2.8.2rc2
  - 2.8.2rc3
references:
- type: WEB
  url: https://github.com/apache/airflow/pull/37881
- type: WEB
  url: https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h574-6646-vfxx