| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow | < 1.10.14 | 1.10.14 |
| airflow | < 1.10.14 | 1.10.14 |
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for [webserver] secret_key config.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free