Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

HOCH 8.1CVE-2022-41672 · BIT-airflow-2022-41672 · GHSA-3q8r-f3pj-3gc4 · Published 07/10/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-41672 ist eine Schwachstelle (HOCH (CVSS 8.1)) in apache-airflow, airflow (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 73.9% aller Schwachstellen.
Abhilfe: auf 2.4.1rc1, 2.4.2rc1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.4.1rc1< 2.4.2rc1`	`2.4.1rc12.4.2rc1`
airflow apache	`≤ 2.4.1`	No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

References

nvd.nist.gov/vuln/detail/CVE-2022-41672 · ADVISORY
apache/airflow#26635 · WEB
apache/airflow commit 12bfb57 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y · WEB
GitHub Advisory GHSA-3q8r-f3pj-3gc4 · ADVISORY

Weitere Schwachstellen in apache-airflow

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.4.1rc1< 2.4.2rc1

2.4.1rc12.4.2rc1

airflow

apache

≤ 2.4.1

No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

Weitere Schwachstellen in apache-airflow

Alle anzeigen →