Description
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | Apache Airflow – < 2.4.0 | 2.4.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Mr-xn/CVE-2022-40127 ★ 41 · Nov 18, 2022
Apache Airflow < 2.4.0 DAG example_bash_operator RCE POC
-
jakabakos/CVE-2022-40127-Airflow-RCE ★ 2 · Jul 21, 2023
CVE-2022-40127 PoC and exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- AirFlow < 2.4.0 - Remote Code Execution http/cves/2022/CVE-2022-40127.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 2.4.0 | 2.4.0 | GHSA-6pw3-8h9w-32gc |