Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

ALTO 8.1CVE-2022-41672 · BIT-airflow-2022-41672 · GHSA-3q8r-f3pj-3gc4 · Published 07/10/2022 · updated 17/06/2026

En resumen

CVE-2022-41672 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a apache-airflow, airflow (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.5%, mayor que el 73.9% de las vulnerabilidades.
Solución: actualizar a 2.4.1rc1, 2.4.2rc1 o posterior.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.4.1rc1< 2.4.2rc1`	`2.4.1rc12.4.2rc1`
airflow apache	`≤ 2.4.1`	No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

References

nvd.nist.gov/vuln/detail/CVE-2022-41672 · ADVISORY
apache/airflow#26635 · WEB
apache/airflow commit 12bfb57 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y · WEB
GitHub Advisory GHSA-3q8r-f3pj-3gc4 · ADVISORY

Más vulnerabilidades de apache-airflow

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.4.1rc1< 2.4.2rc1

2.4.1rc12.4.2rc1

airflow

apache

≤ 2.4.1

No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

Más vulnerabilidades de apache-airflow

Ver todo →