CVE-2021-26559 CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

2021-02-1714:15:14

CWE-284

apache

www.cve.org

cve-2021-26559

cwe-284

access control

apache airflow

privilege escalation

security vulnerability

stable api

EPSS

0.001

Percentile

38.9%

JSON

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when [webserver] expose_config is set to False in airflow.cfg. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

CNA Affected

[
  {
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Airflow 2.0.0"
      }
    ]
  }
]