Skip to content
OpenAdvisories
Medium · 6.1 CVE-2022-40754 BIT-airflow-2022-40754EUVD-2022-0011GHSA-4fg5-j4mm-wfpgPYSEC-2022-280

Open Redirect

Published Sep 21, 2022 · Updated May 27, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow unspecified – < 2.4.0, 2.3.0 – < unspecified 2.4.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow >= 2.3.0, < 2.4.0rc1 2.4.0rc1 GHSA-4fg5-j4mm-wfpg
PyPI apache-airflow >= 2.3.0, < 2.4.0b1 2.4.0b1 PYSEC-2022-280

References