aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +6 more potentially affected by CVE-2021-26559 via apache-airflow (>=1.8.2 <=2.0.0rc3)

apache-airflow PYPI version =1.8.2, =0.1.0rc3, =0.1.0, =2.4.2, =1.7.2, =0.0.5, =0.0.6 Source cves: CVE-2021-26559 Source advisory: OSV:PYSEC-2021-2...

CVE-2021-26559 CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when webserver exposeconfig is set to False in airflow.cfg. This allowed a privilege escalation attack...

CVE-2021-26559

CVE-2021-26559 describes an improper access control on the Stable API Configurations Endpoint in Apache Airflow, allowing users with Viewer or User roles to retrieve Airflow configurations (including sensitive data) even when webserver configuration [webserver] expose_config is set to False. Affe...