PT-2022-12314 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.2.3 and below Description: The "Trigger DAG with config" screen in Apache Airflow is susceptible to XSS attacks via the origin query argument. Recommendations: For Apache Airflow versions 2.2.3 and below, consider...

Apache Airflow Authentication Bypass (CVE-2020-13927)

An authentication bypass vulnerability exists in Apache Airflow API. Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to the affected system...

Improper Privilege Management in apache-airflow

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

GHSA-4JH2-3C85-Q67H Improper Privilege Management in apache-airflow

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

Apache Airflow Privilege Permission and Access Control Issues Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow is vulnerable to a privilege permission and access control issue,...

Privilege Escalation

apache-airflow is vulnerable to privilege escalation. An attacker with only cancreate permission on DAG Runs can create Dag Runs for dags without edit permission...

CVE-2021-45230

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

CVE-2021-45230

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

PYSEC-2022-11

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

PYSEC-2022-11

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

Code injection

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

CVE-2021-45230 Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "cancreate" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for...

CVE-2021-45230

CVE-2021-45230 affects Apache Airflow prior to 2.2.0. The issue arises when a user with can_create on DAG Runs can create Dag Runs for DAGs where they do not have edit permissions, implying insufficient DAG-level permission checks in the web interface. The connected OSV and CVE references corrobo...

PT-2022-12315 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.2.0 Description: The issue affects users with "can create" permissions on DAG Runs, allowing them to create Dag Runs for dags they don't have "edit" permissions for. This is a specific case where the user's...

Apache Airflow 权限许可和访问控制问题漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow is vulnerable to a privilege permission and access control issue,...

Apache Airflow's Experimental API Authentication Bypass

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication...

Apache Airflow Command Injection

A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow...

Poorly Configured Apache Airflow Instances Leak Credentials for Popular Services

Cybersecurity researchers on Monday discovered misconfigurations across older versions of Apache Airflow instances belonging to a number of high-profile companies across various sectors, resulting in the exposure of sensitive credentials for popular platforms and services such as Amazon Web...

Apache Airflow Licensing Issue Vulnerability (CNVD-2022-62076)

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored. Apache Airflow is vulnerable to an authorization issue that stems from a lack of authorization protection on the product's...

Denial Of Service (DoS)

apacheairflow is vulnerable to denial of service. The vulnerability exists due to a lack of check on the endpoint to add/modify Airflow variables used in DAGs, causing the system to crash, expose information or execute code/scripts...