Description
In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Airflow | Apache Airflow < 1.10.12 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 1.10.12 | 1.10.12 | GHSA-4pwq-fj89-6rjc |
Advisories 1
- WID-SEC-2022-0184 Fortinet FortiAnalyzer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
References
- https://lists.apache.org/thread.html/r97e1b60ca508a86be58c43f405c0c8ff00ba467ba0bee68704ae7e3e%40%3Cdev.airflow.apache.org%3E
- [airflow-users] 20201211 CVE-2020-17515: Apache Airflow Reflected XSS via Origin Parameter mailing-list
- [airflow-dev] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list
- [airflow-users] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list
- [oss-security] 20201211 CVE-2020-17515: Apache Airflow Reflected XSS via Origin Parameter mailing-list
- [announce] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list
- [airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list
- [oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list
- [announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list