Apache Airflow contains open redirect

MÉDIO 6.1CVE-2022-40754 · BIT-airflow-2022-40754 · GHSA-4fg5-j4mm-wfpg · Published 21/09/2022 · updated 17/06/2026

Em resumo

CVE-2022-40754 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta apache-airflow, airflow (apache).
Chance de exploração nos próximos 30 dias (EPSS): 1.8%, maior que 78.0% das vulnerabilidades.
Correção: atualize para 2.4.0b1, 2.4.0rc1 ou posterior.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 2.3.0, < 2.4.0b1≥ 2.3.0, < 2.4.0rc1`	`2.4.0b12.4.0rc1`
airflow apache	`≥ 2.3.0, ≤ 2.3.4`	No fix yet

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's /confirm endpoint.

NVD description

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 2.3.0, < 2.4.0b1≥ 2.3.0, < 2.4.0rc1

2.4.0b12.4.0rc1

≥ 2.3.0, ≤ 2.3.4

No fix yet

Mais vulnerabilidades de apache-airflow

Ver tudo →