Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Apache Airflow 2.8.0 Clear all filters
TI-2023-26154 CVE-2023-48291 · GHSA-8f57-wcmg-4jmh

Apache Airflow: Improper access control to DAG resources

Priority LOW 24

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG re…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.018 Published 2023-12-21 Fixed in 2.8.0 CWE-668
TI-2023-25582 CVE-2023-47265 · GHSA-pxch-wr7m-rwxj

Apache Airflow: DAG Params alllow to embed unchecked Javascript

Priority LOW 27

Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01344 Published 2023-12-21 Fixed in 2.8.0, 2.8.0b1 CWE-79
TI-2023-27290 CVE-2023-49920 · GHSA-6m9r-7wrx-xmr6

Apache Airflow: Missing CSRF protection on DAG/trigger

Priority LOW 31

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01032 Published 2023-12-21 Fixed in 2.8.0 CWE-352