Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

ÉLEVÉE 8.1CVE-2022-41672 · BIT-airflow-2022-41672 · GHSA-3q8r-f3pj-3gc4 · Published 07/10/2022 · updated 17/06/2026

En bref

CVE-2022-41672 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant apache-airflow, airflow (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.5%, plus élevée que 73.9% des vulnérabilités.
Correctif : mettre à jour vers 2.4.1rc1, 2.4.2rc1 ou plus récent.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.4.1rc1< 2.4.2rc1`	`2.4.1rc12.4.2rc1`
airflow apache	`≤ 2.4.1`	No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

References

nvd.nist.gov/vuln/detail/CVE-2022-41672 · ADVISORY
apache/airflow#26635 · WEB
apache/airflow commit 12bfb57 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y · WEB
GitHub Advisory GHSA-3q8r-f3pj-3gc4 · ADVISORY

Autres vulnérabilités de apache-airflow

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.4.1rc1< 2.4.2rc1

2.4.1rc12.4.2rc1

airflow

apache

≤ 2.4.1

No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

Autres vulnérabilités de apache-airflow

Tout voir →