AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowGHSA-ffw3-6mp6-jmvj

Improper Access Control in Apache Airflow

Apache Airflow

CVE-2021-26559 · Published Apr 7, 2021 · updated Nov 18, 2024

High6.5
Fix: upgrade to 2.0.1rc1 or later
GitHub advisory

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when [webserver] expose_config is set to False in airflow.cfg. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
>= 2.0.0, < 2.0.1rc12.0.1rc1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-269, CWE-284
Also known as
BIT-airflow-2021-26559, CVE-2021-26559, PYSEC-2021-2

More Apache Airflow advisories

All Apache Airflow
Medium 6.1Jun 18, 2021Cross-site Scripting in Apache AirflowCVE-2021-28359fixed in 1.10.15 +1Medium 5.3Jun 18, 2021Improper Authentication in Apache AirflowCVE-2021-26697fixed in 2.0.1rc1Medium 6.1Jun 18, 2021Apache Airflow Cross-site ScriptingCVE-2020-13944fixed in 1.10.12Critical 9.8Apr 30, 2021Authentication bypass in Apache AirflowCVE-2020-13927fixed in 1.10.11High 7.7Apr 20, 2021Incorrect Session Validation in Apache AirflowCVE-2020-17526fixed in 1.10.14Medium 6.1Apr 20, 2021Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944CVE-2020-17515fixed in 1.10.15rc1 +1