Read the docs
TI-2021-09522 Aliases CVE-2021-28359GHSA-3xxv-p78r-4fc6

Apache Airflow Reflected XSS via Origin Query Argument in URL

Priority MEDIUM 43CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).

Why it matters now

EPSS 0.14389 96th percentileScored 2026-11-07
Fix Fixed Apache Airflow (Apache Software Foundation): 1.10.15apache-airflow (PyPI): 1.10.15, 2.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache AirflowApache Airflow 2.0.0; Apache Airflow 2.0.1; Apache Airflow to before 1.10.151.10.15Patch availableCNA
—apache-airflow (PyPI)before 1.10.151.10.15Patch availableGHSA-3xxv-p78r-4fc6
—apache-airflow (PyPI)2.0.0a1 to before 2.0.22.0.2Patch availableGHSA-3xxv-p78r-4fc6
  • Apache Airflow VendorApache Affected Apache Airflow 2.0.0; Apache Airflow 2.0.1; Apache Airflow to before 1.10.15 Fixed in 1.10.15 Patch available CNA
  • apache-airflow (PyPI) Vendor— Affected before 1.10.15 Fixed in 1.10.15 Patch available GHSA-3xxv-p78r-4fc6
  • apache-airflow (PyPI) Vendor— Affected 2.0.0a1 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-3xxv-p78r-4fc6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*1.0.0 to before 1.10.15; 2.0.0 to before 2.0.2VulnerableApache
  • cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.10.15; 2.0.0 to before 2.0.2 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow (Apache Software Foundation) Fixed in 1.10.15
  • Fix · GHSA-3xxv-p78r-4fc6 apache-airflow (PyPI) Fixed in 1.10.15 Advisory →
  • Fix · GHSA-3xxv-p78r-4fc6 apache-airflow (PyPI) Fixed in 2.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28359
  2. 2026-10-03 Alias added: GHSA-3xxv-p78r-4fc6

References

Advisory 3

Other 5

  • TI-2020-10905 Missing authentication in Apache Airflow KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-09638 OS command injection in Apache Airflow KEVCVSS 3.1HIGH 8.8
  • TI-2022-19017 Apache Airflow <2.4.0 has an RCE in a bash example CVSS 3.1HIGH 8.8
  • TI-2021-16140 Apache Airflow: Variable Import endpoint missed authentication check CVSS 3.1CRITICAL 9.8
  • TI-2022-08169 Apache Airflow: RCE in example DAGs CVSS 3.1HIGH 8.8
  • TI-2024-26776 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler CVSS 3.1HIGH 8.8
See all 157 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences