Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

ALTO 8.1CVE-2022-41672 · BIT-airflow-2022-41672 · GHSA-3q8r-f3pj-3gc4 · Published 07/10/2022 · updated 17/06/2026

Em resumo

CVE-2022-41672 é uma vulnerabilidade ALTO (CVSS 8.1) que afeta apache-airflow, airflow (apache).
Chance de exploração nos próximos 30 dias (EPSS): 1.5%, maior que 73.9% das vulnerabilidades.
Correção: atualize para 2.4.1rc1, 2.4.2rc1 ou posterior.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.4.1rc1< 2.4.2rc1`	`2.4.1rc12.4.2rc1`
airflow apache	`≤ 2.4.1`	No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

References

nvd.nist.gov/vuln/detail/CVE-2022-41672 · ADVISORY
apache/airflow#26635 · WEB
apache/airflow commit 12bfb57 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y · WEB
GitHub Advisory GHSA-3q8r-f3pj-3gc4 · ADVISORY

Mais vulnerabilidades de apache-airflow

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.4.1rc1< 2.4.2rc1

2.4.1rc12.4.2rc1

airflow

apache

≤ 2.4.1

No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

Mais vulnerabilidades de apache-airflow

Ver tudo →