HIGH🇵🇱 Wersja polska

CVE-2024-39877

CVSS 8.8v3.1pub. 2024-07-17upd. 2024-11-21

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Airflow

    APP
    Apache
    2.4.0 – 2.9.3 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2020-13927CRITICAL9.8⚠ KEVten sam produkt

The previous default setting for Airflow's Experimental API was to allow all API requests without authenticati...

CVE-2026-42252CRITICAL9.1PL ✓ten sam produkt

Apache Airflow: command injection przez niebezpieczny wzorzec w dokumentacji BashOperator

CVE-2025-57735CRITICAL9.1PL ✓ten sam produkt

Apache Airflow: brak unieważnienia tokenu JWT po wylogowaniu

CVE-2024-42447CRITICAL9.8PL ✓ten sam produkt

Apache Airflow Providers FAB — nieprawidłowe wygasanie sesji (CWE-613)

CVE-2023-25754CRITICAL9.8ten sam produkt

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affect...