CVE-2024-27906

2024-02-2911:15:08

Google

osv.dev

apache airflow

vulnerability

unauthorized access

dag code

import errors

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

JSON

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.

Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

CPENameOperatorVersion
airfloweqconstraints-2.3.0rc2
airfloweqconstraints-2.8.0
airfloweqconstraints-2.2.0rc1
airfloweqconstraints-2.0.0rc3
airfloweqconstraints-2.8.2rc3
airfloweqconstraints-2.3.0rc1
airfloweqconstraints-2.8.1rc1
airfloweqconstraints-2.1.0rc1
airfloweqconstraints-2.3.0b1
airfloweqconstraints-2.8.2rc2

Name	Operator	Version
airflow	eq	constraints-2.3.0rc2
airflow	eq	constraints-2.8.0
airflow	eq	constraints-2.2.0rc1
airflow	eq	constraints-2.0.0rc3
airflow	eq	constraints-2.8.2rc3
airflow	eq	constraints-2.3.0rc1
airflow	eq	constraints-2.8.1rc1
airflow	eq	constraints-2.1.0rc1
airflow	eq	constraints-2.3.0b1
airflow	eq	constraints-2.8.2rc2