Apache Airflow Command Injection. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 18/01/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow | < 1.10.11rc1 | 1.10.11rc1 |
| airflow | < 1.10.11 | 1.10.11 |
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free