Open Redirect

apache-airflow is vulnerable to open redirect. The vulnerability exists due to the lack of URL filtering in FAB and AirFlow routes in the initapp function of initappbuilder.py, allowing an attacker to redirect users to malicious URLs...

Apache Airflow Contains Open Redirect

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

GHSA-RG94-84XJ-7GQ3 Apache Airflow Contains Open Redirect

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

CVE-2022-45402

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

PYSEC-2022-42984

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

Open redirect

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

PYSEC-2022-42984

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

Arbitrary Code Execution

apacheairflow is vulnerable to arbitrary code execution. The vulnerability exists in example DAGs of examplebashoperator.py which allows an attacker to execute arbitrary commands via the manually provided runid parameter...

EUVD-2022-0019

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

CVE-2022-45402 Apache Airflow: Open redirect during login

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

CVE-2022-45402 Apache Airflow: Open redirect during login

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

CVE-2022-45402 Apache Airflow: Open redirect during login

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

PT-2022-27504 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.4.3 Description: The issue is related to an open redirect in the webserver's "/login" endpoint. This means that an attacker could potentially redirect users to a malicious website after they attempt to log i...

CVE-2022-45402

CVE-2022-45402 affects Apache Airflow versions prior to 2.4.3, which have an open redirect in the webserver’s /login endpoint. The root cause is an open redirect via the login parameter (e.g., next), enabling unvalidated redirects that could be used for phishing. The vulnerability is documented w...

CVE-2022-45402

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's "/login" endpoint...

CVE-2022-45402: URL Redirection to Untrusted Site

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

Apache Airflow vulnerable to OS Command Injection via example DAGs

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow versions prior to 2.4.0...

Apache Airflow subject to Exposure of Sensitive Information

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

GHSA-FVW2-2PF7-77VW Apache Airflow subject to Exposure of Sensitive Information

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

GHSA-6PW3-8H9W-32GC Apache Airflow vulnerable to OS Command Injection via example DAGs

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow versions prior to 2.4.0...