47 results · Clear filters · Feed
-
High 8.8
Docker Provider <3.0 RCE vulnerability in example dag
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.
-
High 8.8
Apache Airflow: RCE in example DAGs
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
-
High 7.7
Incorrect Session Validation in Apache Airflow
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. Th…
-
High 8.8
Remote code execution (RCE) in Apache Airflow
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…
KEV Jan 18, 2022 -
High 7.5
Improper Certificate Validation in Apache Airflow
The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.
-
High 8.8
Cross-Site Request Forgery (CSRF) in Apache Airflow
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
-
High 8.8
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.