Airflow vulnerabilities

46 known vulnerabilities in Airflow from Apache. 46 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Apache Airflow: Improper Control of Generation of Code

  CVE-2022-40127Nov 14, 2022ApacheEPSS 85.7%

  A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

• 7.5 High severity

  Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2022-27949Nov 14, 2022ApacheEPSS 2.37%

  A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apach

• 8.1 High severity

  In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already…

  CVE-2022-41672Oct 7, 2022ApacheEPSS 1.48%

  In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

• 8.8 High severity

  Apache Airflow: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-24288Feb 25, 2022ApacheEPSS 78.4%

  In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

• 9.8 Critical severity

  Apache Airflow's Experimental API Authentication Bypass Exploited

  CVE-2020-13927Nov 10, 2020Apache AirflowEPSS 99.8%

  The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and i

• 8.8 High severity

  Apache Airflow Command Injection Exploited

  CVE-2020-11978Jul 17, 2020ApacheEPSS 99.2%

  An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running