GHSA-6m9r-7wrx-xmr6 · Severity: medium · Ecosystem: pip — Apache Airflow Cross-Site Request Forgery vulnerability
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected
Conclusion & alert: CVE-2023-49920 is rated Moderate Risk (47.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.03%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.18% | 1.03% | +0.86% |
| 2 | 2026-03-04 | 0.14% | 0.18% | +0.04% |
| 3 | 2026-03-01 | — | 0.14% | — |
Full EPSS history (48 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.5 | 3.1 | MEDIUM |
|
2.8 | 3.6 | [email protected] |
GHSA-6m9r-7wrx-xmr6 · Severity: medium · Ecosystem: pip — Apache Airflow Cross-Site Request Forgery vulnerability
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/12/21/3 | Mailing List Third Party Advisory |
| https://github.com/apache/airflow/pull/36026 | Patch |
| https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq | Mailing List Third Party Advisory |