Apache Airflow: Dag Code and Import Error Permissions Ignored
Priority LOW 26CWE-862Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 27th percentileScored 2026-11-07
Fix Fixed Apache Airflow (Apache Software Foundation): 2.8.2apache-airflow (PyPI): 2.8.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Airflow | before 2.8.2 | 2.8.2 | Patch available | CNA |
| — | apache-airflow (PyPI) | before 2.8.2 | 2.8.2 | Patch available | GHSA-6v6w-h8m6-7mv2 |
- Apache Airflow VendorApache Affected before 2.8.2 Fixed in 2.8.2 Patch available CNA
- apache-airflow (PyPI) Vendor— Affected before 2.8.2 Fixed in 2.8.2 Patch available GHSA-6v6w-h8m6-7mv2
Remediation
- Fix · CNA Apache Airflow (Apache Software Foundation) Fixed in 2.8.2
- Fix · GHSA-6v6w-h8m6-7mv2 apache-airflow (PyPI) Fixed in 2.8.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27906
- 2026-10-03 Alias added: GHSA-6v6w-h8m6-7mv2
References
Advisory 2
Other 12
- https://github.com/apache/airflow/commit/08d25607abe8593ecb90a84e338896bb79692d7b
- https://github.com/apache/airflow/commit/0a95299691e2d6a9b874adfae94d246a7f681ec9
- https://github.com/apache/airflow/commit/2adbe882e68df0e2b1084bc869616bb01e416aa7
- https://github.com/apache/airflow/commit/2cb6027280bcf5e2b561f3ee7f55980f6ec4cc3a
- https://github.com/apache/airflow/commit/90255d9d44a649025f588497f6c82177dad48326
- https://github.com/apache/airflow/commit/9c4defa08268322b9db80123a22d7b56b2063446
- https://github.com/apache/airflow/commit/a7fa258ba1c69a18e0f620499625f6026768dc24
- https://github.com/apache/airflow/commit/bc2646be043f71b4d1ab7eefd2af65a60bf919f2
- https://github.com/apache/airflow/commit/d944eb0de216d9e1d125fae5ce4af7440154deb4
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-245.yaml
- http://www.openwall.com/lists/oss-security/2024/02/29/1
More Apache Airflow vulnerabilities
- TI-2020-10905 Missing authentication in Apache Airflow KEVCVSS 3.1CRITICAL 9.8
- TI-2020-09638 OS command injection in Apache Airflow KEVCVSS 3.1HIGH 8.8
- TI-2022-19017 Apache Airflow <2.4.0 has an RCE in a bash example CVSS 3.1HIGH 8.8
- TI-2021-16140 Apache Airflow: Variable Import endpoint missed authentication check CVSS 3.1CRITICAL 9.8
- TI-2022-08169 Apache Airflow: RCE in example DAGs CVSS 3.1HIGH 8.8
- TI-2024-26776 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler CVSS 3.1HIGH 8.8
Sources
- CVE-2024-27906 · CVE Program
- CVE-2024-27906 · NVD
- FIRST EPSS
- GHSA-6v6w-h8m6-7mv2 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-27906 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences