Apache Airflow vulnerabilities

CVE-2024-29735 [MEDIUM] CWE-281 CVE-2024-29735: Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airfl Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the

CVE-2020-17513 [MEDIUM] CWE-918 CVE-2020-17513: In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

CVE-2024-41937 [MEDIUM] CWE-79 CVE-2024-41937: Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a maliciou Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, whic

CVE-2023-39441 [MEDIUM] CWE-295 CVE-2023-39441: Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Air Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosu

CVE-2022-40954 [MEDIUM] CWE-78 CVE-2022-40954: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airf

CVE-2020-9485 [MEDIUM] CWE-79 CVE-2020-9485: An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was disc An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.

CVE-2021-45229 [MEDIUM] CWE-79 CVE-2021-45229: It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the ` It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

CVE-2018-20244 [MEDIUM] CWE-79 CVE-2018-20244: In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airfl In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

CVE-2024-32077 [MEDIUM] CWE-79 CVE-2024-32077: Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject mal Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.

CVE-2020-11983 [MEDIUM] CWE-79 CVE-2020-11983: An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.

CVE-2024-27906 [MEDIUM] CWE-862 CVE-2024-27906: Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view D Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

CVE-2023-47265 [MEDIUM] CWE-79 CVE-2023-47265: Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exi

CVE-2024-50378 [MEDIUM] CWE-201 CVE-2024-50378: Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log a Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limit

CVE-2023-29247 [MEDIUM] CWE-79 CVE-2023-29247: Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.

CVE-2024-39863 [MEDIUM] CWE-79 CVE-2024-39863: Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to i Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.

CVE-2024-26280 [MEDIUM] CWE-276 CVE-2024-26280: Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to

CVE-2025-54941 [MEDIUM] CWE-78 CVE-2025-54941: An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redir An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator`

CVE-2022-43985 [MEDIUM] CWE-601 CVE-2022-43985: In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.

CVE-2022-43982 [MEDIUM] CWE-79 CVE-2022-43982: In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to X In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

CVE-2024-25142 [MEDIUM] CWE-525 CVE-2024-25142: Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgra