CVE-2023-50944: 
Apache Airflow vulnerability analysis and mitigation

CVE-2023-50944 affects Apache Airflow versions before 2.8.1, where an authenticated user can access the source code of a DAG (Directed Acyclic Graph) to which they don't have access permissions. The vulnerability was discovered by Timon8 Zhang and disclosed on January 24, 2024 (Apache Advisory).

The vulnerability stems from a missing authorization check when accessing DAG source code. The issue has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with low attack complexity and requiring low privileges (NVD).

The vulnerability allows authenticated users to view the source code of DAGs they shouldn't have access to, potentially exposing sensitive information contained within the DAG configurations. The impact is limited to confidentiality breach with no effect on integrity or availability (Apache Advisory).

Users are strongly recommended to upgrade to Apache Airflow version 2.8.1, which includes the fix for this vulnerability. The fix implements proper permission verification before allowing access to DAG source code (GitHub PR).