CVE-2024-27906 Apache Airflow: Dag Code and Import Error Permissions Ignored

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk...

CVE-2024-27906 Apache Airflow: Dag Code and Import Error Permissions Ignored

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

PT-2024-1970 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.8.2 Description: The issue allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. This is related to the disclosure of informati...

Missing Certificate Validation

apacheairflowprovidersmongo is vulnerable to Missing Certificate Validation. The vulnerability is due to the default inclusion of the allowinsecure option when SSL was enabled. This flaw resulted in certificates not being properly validated...

GHSA-X5PM-H33Q-CJRW Improper Certificate Validation in apache airflow mongo hook

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

Improper Certificate Validation in apache airflow mongo hook

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2024-25141 Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2024-25141 Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

Apache Airflow 信任管理问题漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from a trust management issue vulnerability that stems from...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the lack of protection for operational data, allowing attackers to obtain confidential information.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to expose sensitive information, provided...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the lack of protection for operational data, allowing attackers to gain access to and read this data.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow, related to the disclosure of protected information, allows attackers to reveal the configuration of arbitrary tasks.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to the exposure of protected information. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the configuration of arbitrary tasks...

The vulnerability of the Apache Airflow network software, related to the exposure of protected information, allows attackers to view warnings related to all DAGs in Airflow.

The vulnerability of the Apache Airflow network software relates to the exposure of protected information. Exploiting this vulnerability allows a malicious actor to monitor all DAGs in Airflow...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in authentication errors, which allow attackers to modify arbitrary data.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to authentication errors. Exploiting this vulnerability allows a malicious actor to modify arbitrary data remotely...

Internet Bug Bounty: Apache Airflow: Bypass permission verification to read code of other dags

CVE-2023-50944: Apache Airflow: Bypass permission verification to read code of other dags Severity: low Affected versions: Apache Airflow before 2.8.1 Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to...

The vulnerability of the software responsible for creating, monitoring, and orchestrating data processing scripts in Airflow is related to deficiencies in the deserialization mechanism. This allows attackers to replace the XCom data, thereby bypassing the protection provided by the “enable_xcom_pickling=False” configuration setting.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to replace the XCom data, thereby bypassing the protection provided b...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow lies in the lack of authentication. This allows attackers to gain access to the source code of DAGs.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor to gain access to the source code of DAGs...

Apache Airflow Information Disclosure Vulnerability (CNVD-2024-26532)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

Apache Airflow Code Execution Vulnerability (CNVD-2024-26531)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A code execution vulnerability exists in Apache Airflow versions prior to 2.8.1,...