Remote Code Execution (RCE)

airflow is vulnerable to remote code execution RCE . It can happen because it passes user-controllable data as the default parameters to the python eval function which directly executes the parameters. Therefore any users who can create or edit charts can trigger the attack in airflow server...

Cross-site Request Forgery (CSRF)

Airflow is vulnerable to cross-site request forgery CSRF. The paused and query methods are state-changing, allowing CSRF...

CVE-2023-27381

...

CVE-2023-27381

CVE-2023-27381 is rejected as unused by its CNA and does not represent an active vulnerability entry.