Apache Airflow exposes arbitrary file content

MEDIUM 4.7CVE-2022-38170 · BIT-airflow-2022-38170 · GHSA-q8h9-pqcx-59hw · Published 02/09/2022 · updated 17/06/2026

In short

CVE-2022-38170 is a MEDIUM (CVSS 4.7) vulnerability affecting apache-airflow, airflow (apache).
Chance of exploitation in the next 30 days (EPSS): 0.62%, higher than 49.6% of all vulnerabilities.
Fix: update to 2.3.4 or later.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.3.4`	`2.3.4`
airflow apache	`< 2.3.4`	`2.3.4`

Description

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the --daemon flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

NVD description

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.