Airflow
by Apache
Source repositories
CVEs (142)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-35005 | 0.00 | — | 0.02 | Jun 19, 2023 | In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all… | |||
| CVE-2023-25754 | 0.00 | — | 0.02 | May 8, 2023 | Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0. | |||
| CVE-2023-29247 | 0.00 | — | 0.02 | May 8, 2023 | Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0. | |||
| CVE-2023-25695 | 0.00 | — | 0.01 | Mar 15, 2023 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2. | |||
| CVE-2023-22884 | 0.00 | — | 0.11 | Jan 21, 2023 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL… | |||
| CVE-2022-41131 | 0.00 | — | 0.02 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue… | |||
| CVE-2022-40189 | 0.00 | — | 0.04 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue… | |||
| CVE-2022-38649 | 0.00 | — | 0.03 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue… | |||
| CVE-2022-40954 | 0.00 | — | 0.01 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue… | |||
| CVE-2022-45402 | 0.00 | — | 0.82 | Nov 15, 2022 | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. | |||
| CVE-2022-40127 | 0.00 | — | 0.86 | Nov 14, 2022 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. | |||
| CVE-2022-27949 | 0.00 | — | 0.02 | Nov 14, 2022 | A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to… | |||
| CVE-2022-43982 | 0.00 | — | 0.01 | Nov 2, 2022 | In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. | |||
| CVE-2022-43985 | 0.00 | — | 0.01 | Nov 2, 2022 | In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. | |||
| CVE-2022-41672 | 0.00 | — | 0.01 | Oct 7, 2022 | In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. | |||
| CVE-2022-40754 | 0.00 | — | 0.01 | Sep 21, 2022 | In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint. | |||
| CVE-2022-40604 | 0.00 | — | 0.02 | Sep 21, 2022 | In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction. | |||
| CVE-2022-38170 | 0.00 | — | 0.01 | Sep 2, 2022 | In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary… | |||
| CVE-2022-38054 | 0.00 | — | 0.02 | Sep 2, 2022 | In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation. | |||
| CVE-2022-38362 | 0.00 | — | 0.02 | Aug 16, 2022 | Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. |
- CVE-2023-35005Jun 19, 2023risk 0.00cvss —epss 0.02
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all…
- CVE-2023-25754May 8, 2023risk 0.00cvss —epss 0.02
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.
- CVE-2023-29247May 8, 2023risk 0.00cvss —epss 0.02
Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.
- CVE-2023-25695Mar 15, 2023risk 0.00cvss —epss 0.01
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.
- CVE-2023-22884Jan 21, 2023risk 0.00cvss —epss 0.11
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL…
- CVE-2022-41131Nov 22, 2022risk 0.00cvss —epss 0.02
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue…
- CVE-2022-40189Nov 22, 2022risk 0.00cvss —epss 0.04
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue…
- CVE-2022-38649Nov 22, 2022risk 0.00cvss —epss 0.03
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue…
- CVE-2022-40954Nov 22, 2022risk 0.00cvss —epss 0.01
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue…
- CVE-2022-45402Nov 15, 2022risk 0.00cvss —epss 0.82
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
- CVE-2022-40127Nov 14, 2022risk 0.00cvss —epss 0.86
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
- CVE-2022-27949Nov 14, 2022risk 0.00cvss —epss 0.02
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to…
- CVE-2022-43982Nov 2, 2022risk 0.00cvss —epss 0.01
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.
- CVE-2022-43985Nov 2, 2022risk 0.00cvss —epss 0.01
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
- CVE-2022-41672Oct 7, 2022risk 0.00cvss —epss 0.01
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
- CVE-2022-40754Sep 21, 2022risk 0.00cvss —epss 0.01
In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.
- CVE-2022-40604Sep 21, 2022risk 0.00cvss —epss 0.02
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
- CVE-2022-38170Sep 2, 2022risk 0.00cvss —epss 0.01
In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary…
- CVE-2022-38054Sep 2, 2022risk 0.00cvss —epss 0.02
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
- CVE-2022-38362Aug 16, 2022risk 0.00cvss —epss 0.02
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.
Page 6 of 8