Skip to content
OpenAdvisories
Medium · 6.1 CVE-2022-43985 BIT-airflow-2022-43985EUVD-2022-0015GHSA-f9fq-78ch-4wmjPYSEC-2022-42971

Apache Airflow prior to 2.4.2 has an open redirect

Published Nov 2, 2022 · Updated May 2, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow unspecified – < 2.4.2 2.4.2

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow < 2.4.2rc1 2.4.2rc1 GHSA-f9fq-78ch-4wmj
PyPI apache-airflow < 2.4.2 2.4.2 PYSEC-2022-42971

References