Airflow Security Vulnerabilities and Issues — Airflow CVE List

Lucene search

ApacheAirflow

9 matches found

CVE•added 2022/11/14 10:15 a.m.•99 views

CVE-2022-40127

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

8.8CVSS8.8AI score0.93751EPSS

CVE•added 2022/11/15 9:15 a.m.•88 views

CVE-2022-45402

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint.

6.1CVSS6AI score0.37664EPSS

CVE•added 2022/11/22 10:15 a.m.•84 views

CVE-2022-40189

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider v...

9.8CVSS9.7AI score0.02121EPSS

CVE•added 2022/11/22 10:15 a.m.•82 views

CVE-2022-38649

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

9.8CVSS9.7AI score0.03083EPSS

CVE•added 2022/11/14 10:15 a.m.•81 views

CVE-2022-27949

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.

7.5CVSS7.4AI score0.00235EPSS

CVE•added 2022/11/22 10:15 a.m.•76 views

CVE-2022-41131

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider...

7.8CVSS7.9AI score0.00194EPSS

CVE•added 2022/11/22 10:15 a.m.•74 views

CVE-2022-40954

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider ver...

5.5CVSS5.5AI score0.00598EPSS

CVE•added 2022/11/02 12:15 p.m.•71 views

CVE-2022-43985

In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint.

6.1CVSS6AI score0.02534EPSS

CVE•added 2022/11/02 12:15 p.m.•65 views

CVE-2022-43982

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument.

6.1CVSS5.9AI score0.04972EPSS