CVE-2023-50943: 
Apache Airflow vulnerability analysis and mitigation

Apache Airflow versions before 2.8.1 contain a vulnerability that allows potential attackers to poison XCom data by bypassing the protection of the 'enable_xcom_pickling=False' configuration setting. This results in poisoned data after XCom deserialization. The vulnerability was discovered by Peng Zhou and remediated by Hussein Awala, with the fix being released in version 2.8.1 (OSS Security).

The vulnerability is tracked as CVE-2023-50943 and has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The issue is classified as CWE-502 (Deserialization of Untrusted Data) and affects the XCom functionality in Apache Airflow (NVD).

The vulnerability allows an attacker to bypass security controls and potentially execute malicious code through poisoned XCom data after deserialization. However, the impact is considered low since it specifically requires a DAG author to exploit it (OSS Security).

Users are strongly recommended to upgrade to Apache Airflow version 2.8.1 or later, which contains the fix for this vulnerability. The issue was addressed through a pull request that stops deserializing pickle when enable_xcom_pickling is set to False (GitHub PR).