Apache Airflow exposes arbitrary file content

MOYENNE 4.7CVE-2022-38170 · BIT-airflow-2022-38170 · GHSA-q8h9-pqcx-59hw · Published 02/09/2022 · updated 17/06/2026

En bref

CVE-2022-38170 est une vulnérabilité MOYENNE (CVSS 4.7) touchant apache-airflow, airflow (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.62%, plus élevée que 49.6% des vulnérabilités.
Correctif : mettre à jour vers 2.3.4 ou plus récent.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.3.4`	`2.3.4`
airflow apache	`< 2.3.4`	`2.3.4`

Description

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the --daemon flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

NVD description

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.