Apache Airflow Scheduler Exec via DAG Local Settings Before 2.10.1
CVE-2024-45034 Published on September 7, 2024
Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author.
Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
Vulnerability Analysis
CVE-2024-45034 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Execution with Unnecessary Privileges
The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Products Associated with CVE-2024-45034
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-45034 are published in Apache AirFlow:
Affected Versions
Apache Software Foundation Apache Airflow:- Before 2.10.1 is affected.
- Before 2.10.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.