Apache Airflow vulnerabilities
55 known vulnerabilities in Apache Airflow from Apache. 55 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Apache Airflow: Improper Preservation of Permissions
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflo
- 7.5 High severity
Apache Airflow: Deserialization of Untrusted Data
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This v
- 7.5 High severity
Apache Airflow Celery provider: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the
- 8.0 High severity
Apache Airflow: Session Fixation
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session
- 8.1 High severity
Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connect
- 8.8 High severity
Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It
- 9.8 Critical severity
Apache Airflow: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Air
- 7.8 High severity
Apache Airflow Hive Provider: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG
- 9.8 Critical severity
Apache Airlfow Pig Provider: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG f
- 9.8 Critical severity
Apache Airflow Pinot Provider: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG
- 8.8 High severity
Apache Airflow: Improper Control of Generation of Code
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
- 7.5 High severity
Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apach
- 8.1 High severity
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already…
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
- 8.8 High severity
Apache Airflow: Improper Neutralization of Special Elements used in an OS Command
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
- 8.8 High severity
Apache Airflow Command Injection Exploited
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running