PYSEC-2020-18

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

PT-2020-6602 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.11 Description: The issue is related to the Experimental API in Apache Airflow, which previously allowed all API requests without authentication by default. This poses security risks to users who are not...

CVE-2020-13927

Apache Airflow CVE-2020-13927: An authentication bypass existed in the Experimental API where unauthenticated requests could be processed by default in older Airflow versions. The issue was mitigated by changing the default from allowing all API requests to denying them by default starting with A...

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

CVE-2020-13927

The previous default setting for Airflow’s Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2020-52628)

Apache Airflow is an open source tool for orchestrating complex computational workflows and data processing pipelines. A cross-site scripting vulnerability exists in the 'origin' parameter passed to certain endpoints in Apache Airflow versions prior to 1.10.12. No detailed vulnerability details a...

CVE-2020-13944

In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...

CVE-2020-13944

In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...

Design/Logic Flaw

In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...

PYSEC-2020-19

In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...

PYSEC-2020-19

In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...

CVE-2020-13944

The vulnerability described as CVE-2020-13944 affects Apache Airflow via a Cross‑Site Scripting (XSS) flaw in the origin parameter for some endpoints (notably /trigger) in older Airflow releases. Connected advisories reiter that the issue occurs in <1.10.12 (and related

CVE-2020-13944

In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...

PT-2020-13795 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.12 Description: The issue concerns a XSS exploit in Apache Airflow. The origin parameter passed to certain endpoints, such as /trigger, is vulnerable to this exploit. Recommendations: For versions prior t...

GHSA-J38C-25FJ-MR84 Stored XSS in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI...

Stored XSS in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI...

Insecure default config of Celery worker in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker Redis, RabbitMQ directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack and thus remote code...

GHSA-976R-QFJJ-C24W Command injection via Celery broker in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker Redis, RabbitMQ directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands...

GHSA-9G2W-5F3V-MFMM Insecure default config of Celery worker in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker Redis, RabbitMQ directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack and thus remote code...