2.7.1

DATE	CVE	VULNERABILITY TITLE	RISK
2023-10-14	CVE-2023-42792	Exposure of Resource to Wrong Sphere vulnerability in Apache Airflow Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. network low complexity apache CWE-668	6.5
2023-10-14	CVE-2023-45348	Unspecified vulnerability in Apache Airflow 2.7.0/2.7.1 Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". network low complexity apache	4.3
2023-09-12	CVE-2023-40611	Incorrect Authorization vulnerability in Apache Airflow Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. network low complexity apache CWE-863	4.3