Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Airflow

169 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-22884 Public exploit EPSS 12%

    Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Ai…

    Apache Software Foundation Apache Airflow Apache Airflow MySQL Provider apache-airflow PyPI
  • Critical 9.8
    CVE-2021-38540 Public exploit EPSS 81%

    Apache Airflow: Variable Import endpoint missed authentication check

    The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclo…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Critical 9.8
    CVE-2020-11981 Public exploit EPSS 37%

    Command injection via Celery broker in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

    Apache Software Foundation Apache Airflow apache-airflow PyPI