Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

高危 8.1CVE-2022-41672 · BIT-airflow-2022-41672 · GHSA-3q8r-f3pj-3gc4 · Published 07/10/2022 · updated 17/06/2026

要点

CVE-2022-41672 是影响 apache-airflow, airflow (apache) 的高危 (CVSS 8.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.5%，高于 73.9% 的漏洞。
修复：升级到 2.4.1rc1, 2.4.2rc1 或更高版本。

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.4.1rc1< 2.4.2rc1`	`2.4.1rc12.4.2rc1`
airflow apache	`≤ 2.4.1`	No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

References

nvd.nist.gov/vuln/detail/CVE-2022-41672 · ADVISORY
apache/airflow#26635 · WEB
apache/airflow commit 12bfb57 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y · WEB
GitHub Advisory GHSA-3q8r-f3pj-3gc4 · ADVISORY

apache-airflow 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.4.1rc1< 2.4.2rc1

2.4.1rc12.4.2rc1

airflow

apache

≤ 2.4.1

No fix yet

Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVD description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

apache-airflow 的其他漏洞

查看全部 →