Apache Airflow
Known Exploited Apache Airflow Vulnerabilities
The following Apache Airflow vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
Title | Description | Added |
---|---|---|
Apache Airflow Command Injection | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. CVE-2020-11978 | January 18, 2022 |
By the Year
In 2023 there have been 2 vulnerabilities in Apache Airflow with an average score of 7.6 out of ten. Last year Airflow had 17 security vulnerabilities published. Right now, Airflow is on track to have less security vulnerabilities in 2023 than it did last year. However, the average CVE base score of the vulnerabilities in 2023 is greater by 0.31.
Year | Vulnerabilities | Average Score |
---|---|---|
2023 | 2 | 7.55 |
2022 | 17 | 7.24 |
2021 | 6 | 6.38 |
2020 | 12 | 7.18 |
2019 | 5 | 6.28 |
2018 | 0 | 0.00 |
It may take a day or so for new Airflow vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Airflow Security Vulnerabilities
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.
CVE-2023-25695
5.3 - Medium
- March 15, 2023
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.
Generation of Error Message Containing Sensitive Information
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow
CVE-2023-22884
9.8 - Critical
- January 21, 2023
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.
Command Injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow
CVE-2022-38649
7.8 - High
- November 22, 2022
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pinot Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
Shell injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow
CVE-2022-40189
9.8 - Critical
- November 22, 2022
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pig Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
Shell injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow
CVE-2022-40954
5.5 - Medium
- November 22, 2022
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed).
Shell injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow
CVE-2022-41131
7.8 - High
- November 22, 2022
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the HIve Provider version 4.1.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Hive Provider installed).
Shell injection
In Apache Airflow versions prior to 2.4.3
CVE-2022-45402
6.1 - Medium
- November 15, 2022
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
Open Redirect
A vulnerability in UI of Apache Airflow
CVE-2022-27949
7.5 - High
- November 14, 2022
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.
Information Disclosure
A vulnerability in Example Dags of Apache Airflow
CVE-2022-40127
8.8 - High
- November 14, 2022
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
Code Injection
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks
CVE-2022-43982
6.1 - Medium
- November 02, 2022
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.
XSS
In Apache Airflow versions prior to 2.4.2
CVE-2022-43985
6.1 - Medium
- November 02, 2022
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
Open Redirect
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user
CVE-2022-41672
8.1 - High
- October 07, 2022
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
Insufficient Session Expiration
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted
CVE-2022-40604
7.5 - High
- September 21, 2022
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
Use of Externally-Controlled Format String
In Apache Airflow 2.3.0 through 2.3.4
CVE-2022-40754
6.1 - Medium
- September 21, 2022
In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.
Open Redirect
In Apache Airflow versions 2.2.4 through 2.3.3
CVE-2022-38054
9.8 - Critical
- September 02, 2022
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
Session Fixation
In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and
CVE-2022-38170
4.7 - Medium
- September 02, 2022
In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
Race Condition
It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument
CVE-2021-45229
6.1 - Medium
- February 25, 2022
It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.
XSS
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection
CVE-2022-24288
8.8 - High
- February 25, 2022
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Shell injection
In Apache Airflow prior to 2.2.0
CVE-2021-45230
6.5 - Medium
- January 20, 2022
In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3
CVE-2021-38540
9.8 - Critical
- September 09, 2021
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
Missing Authentication for Critical Function
If remote logging is not used
CVE-2021-35936
5.3 - Medium
- August 16, 2021
If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.
Missing Authentication for Critical Function
Flask-AppBuilder is a development framework, built on top of Flask
CVE-2021-29621
5.3 - Medium
- June 07, 2021
Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
Side Channel Attack
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit
CVE-2021-28359
6.1 - Medium
- May 02, 2021
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).
XSS
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0
CVE-2021-26697
5.3 - Medium
- February 17, 2021
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
Missing Authentication for Critical Function
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow
CVE-2021-26559
6.5 - Medium
- February 17, 2021
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config
CVE-2020-17526
7.7 - High
- December 21, 2020
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
In Apache Airflow versions prior to 1.10.13
CVE-2020-17513
5.3 - Medium
- December 14, 2020
In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.
XSPA
In Airflow versions prior to 1.10.13
CVE-2020-17511
6.5 - Medium
- December 14, 2020
In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.
Cleartext Storage of Sensitive Information
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit
CVE-2020-17515
6.1 - Medium
- December 11, 2020
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
XSS
The previous default setting for Airflow's Experimental API was to
CVE-2020-13927
9.8 - Critical
- November 10, 2020
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
Insecure Default Initialization of Resource
In Apache Airflow < 1.10.12
CVE-2020-13944
6.1 - Medium
- September 17, 2020
In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.
XSS
An issue was found in Apache Airflow versions 1.10.10 and below
CVE-2020-11983
5.4 - Medium
- July 17, 2020
An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.
XSS
An issue was found in Apache Airflow versions 1.10.10 and below
CVE-2020-11982
9.8 - Critical
- July 17, 2020
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Marshaling, Unmarshaling
An issue was found in Apache Airflow versions 1.10.10 and below
CVE-2020-11981
9.8 - Critical
- July 17, 2020
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Shell injection
An issue was found in Apache Airflow versions 1.10.10 and below
CVE-2020-11978
8.8 - High
- July 17, 2020
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Shell injection
An issue was found in Apache Airflow versions 1.10.10 and below
CVE-2020-9485
6.1 - Medium
- July 17, 2020
An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.
XSS
In Apache Airflow before 1.10.5 when running with the "classic" UI
CVE-2019-12398
4.8 - Medium
- January 14, 2020
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
XSS
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views
CVE-2019-12417
4.8 - Medium
- October 30, 2019
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
XSS
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
CVE-2019-0216
4.8 - Medium
- April 10, 2019
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
XSS
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
CVE-2019-0229
8.8 - High
- April 10, 2019
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
Session Riding
In Apache Airflow before 1.10.2
CVE-2018-20244
5.5 - Medium
- February 27, 2019
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
XSS
The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions
CVE-2018-20245
7.5 - High
- January 23, 2019
The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.
Improper Certificate Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Airflow or by Apache? Click the Watch button to subscribe.
