Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table

ALTO 8.4CVE-2024-56373 · BIT-airflow-2024-56373 · GHSA-r837-hpv7-pc2f · Published 24/02/2026 · updated 17/06/2026

En resumen

CVE-2024-56373 es una vulnerabilidad ALTO (CVSS 8.4) que afecta a apache-airflow, airflow (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 69.0% de las vulnerabilidades.
Solución: actualizar a 2.11.1 o posterior.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.11.1`	`2.11.1`
airflow apache	`< 2.11.1`	`2.11.1`

Description

The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.

NVD description

DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.