Apache Airflow: DAG Code and Import Error Permissions Ignored

MOYENNE 5.9CVE-2024-27906 · BIT-airflow-2024-27906 · GHSA-6v6w-h8m6-7mv2 · Published 29/02/2024 · updated 17/06/2026

En bref

CVE-2024-27906 est une vulnérabilité MOYENNE (CVSS 5.9) touchant apache-airflow, airflow (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 28.1% des vulnérabilités.
Correctif : mettre à jour vers 2.8.2 ou plus récent.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.8.2`	`2.8.2`
airflow apache	`< 2.8.2`	`2.8.2`

Description

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.

Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

NVD description

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

References

nvd.nist.gov/vuln/detail/CVE-2024-27906 · ADVISORY
apache/airflow#37290 · WEB
apache/airflow#37468 · WEB
apache/airflow commit 08d2560 · WEB
apache/airflow commit 0a95299 · WEB
apache/airflow commit 2adbe88 · WEB
apache/airflow commit 2cb6027 · WEB
apache/airflow commit 90255d9 · WEB
apache/airflow commit 9c4defa · WEB
apache/airflow commit a7fa258 · WEB
apache/airflow commit bc2646b · WEB
apache/airflow commit d944eb0 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5 · WEB
openwall.com/lists/oss-security/2024/02/29/1 · WEB
GitHub Advisory GHSA-6v6w-h8m6-7mv2 · ADVISORY

Autres vulnérabilités de apache-airflow

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.8.2

2.8.2

airflow

apache

< 2.8.2

2.8.2

Description

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.

Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

NVD description

Autres vulnérabilités de apache-airflow

Tout voir →