Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the
    XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in
    poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG
    author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.
    (CVE-2023-50943)

ID	Name	Product	Family	Type	Severity
460907	Echo: apache-airflow: security update to 2.8.1rc1	Tenable Cloud Security	Echo Local Security Checks	Local	high
460907	Echo: apache-airflow: security update to 2.8.1rc1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
413616	SCA: security update for apache-airflow (GHSA-c3c6-f2ww-xfr2)	Tenable Cloud Security	SCA Checks	Local	high
413616	SCA: security update for apache-airflow (GHSA-c3c6-f2ww-xfr2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2023-50943

high

Tenable Plugins

high

high

high

high