CVE-2023-35908: 
Apache Airflow vulnerability analysis and mitigation

Apache Airflow versions before 2.6.3 are affected by a vulnerability that allows unauthorized read access to a DAG (Directed Acyclic Graph) through the URL. The vulnerability was discovered and disclosed in July 2023, affecting all versions of Apache Airflow prior to version 2.6.3 (NVD, Debian Tracker).

The vulnerability stems from an authentication bypass issue where the DAG ID was only being checked in request args and form but not kwargs, making it possible for the ID when passed as kwargs to be None. This security flaw is classified as an Incorrect Authorization vulnerability (CWE-863). The CVSS v3.1 base score is 6.5 (MEDIUM), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows unauthorized users to gain read access to DAGs through URL manipulation, potentially exposing sensitive workflow information. The impact is limited to confidentiality (read access) with no direct effect on integrity or availability of the system (NVD).

The recommended mitigation is to upgrade Apache Airflow to version 2.6.3 or later. The fix involves checking the DAG ID in query parameters from the URL as well as kwargs to prevent unauthorized access (GitHub PR).