Apache Airflow contains open redirect

MEDIO 6.1CVE-2022-40754 · BIT-airflow-2022-40754 · GHSA-4fg5-j4mm-wfpg · Published 21/09/2022 · updated 17/06/2026

In breve

CVE-2022-40754 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda apache-airflow, airflow (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 78.0% delle vulnerabilità.
Correzione: aggiornare a 2.4.0b1, 2.4.0rc1 o successiva.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 2.3.0, < 2.4.0b1≥ 2.3.0, < 2.4.0rc1`	`2.4.0b12.4.0rc1`
airflow apache	`≥ 2.3.0, ≤ 2.3.4`	No fix yet

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's /confirm endpoint.

NVD description

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 2.3.0, < 2.4.0b1≥ 2.3.0, < 2.4.0rc1

2.4.0b12.4.0rc1

≥ 2.3.0, ≤ 2.3.4

No fix yet

Altre vulnerabilità di apache-airflow

Vedi tutto →