Description
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | Apache Airflow 2.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | >= 2.0.0, < 2.0.1rc1 | 2.0.1rc1 | GHSA-ffw3-6mp6-jmvj |
| PyPI | apache-airflow | < 2.0.1 | 2.0.1 | PYSEC-2021-2 |
References
- https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E
- [oss-security] 20210217 CVE-2021-26559: Apache Airflow 2.0.0: CWE-284 Improper Access Control on Configurations Endpoint for the Stable API mailing-list
- [announce] 20210217 CVE-2021-26559: Apache Airflow: CWE-284 Privilege Escalation Attack mailing-list