Apache AirflowGHSA-fh37-cx83-q542
Improper Authentication in Apache Airflow
Medium5.3CVE-2021-26697 · Published Jun 18, 2021 · updated Sep 12, 2024
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue only affects Apache Airflow 2.0.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 2.0.0, < 2.0.1rc1 | 2.0.1rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-269, CWE-287, CWE-306
- Also known as
- BIT-airflow-2021-26697, CVE-2021-26697, PYSEC-2021-3
- nvd.nist.gov/vuln/detail/CVE-2021-26697
- github.com/apache/airflow/commit/21cedff205e7d62675949fda2aa4616d77232b76
- github.com/apache/airflow/commit/24a54242d56058846c7978130b3f37ca045d5142
- github.com/apache/airflow/commit/93957e917ff4cfb0be11aef088bd9527cf728a04
- github.com/advisories/GHSA-fh37-cx83-q542
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2021-3.yaml
- lists.apache.org/thread.html/r36111262a59219a3e2704c71e97cf84937dae5ba7a1da99499e5d8f9@%3Cannounce.apache.org%3E
- lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E
- lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519@%3Cdev.airflow.apache.org%3E
- lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519@%3Cusers.airflow.apache.org%3E
- www.openwall.com/lists/oss-security/2021/02/17/2
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 182021 | Cross-site Scripting in Apache Airflow Medium6.1Jun 18, 2021 | Medium6.1 | 1.10.15+1 more |
| Jun 182021 | Apache Airflow Cross-site ScriptingMedium6.1Jun 18, 2021 | Medium6.1 | 1.10.12 |
| Apr 302021 | Authentication bypass in Apache AirflowCritical9.8Apr 30, 2021 | Critical9.8 | 1.10.11 |
| Apr 202021 | Incorrect Session Validation in Apache AirflowHigh7.7Apr 20, 2021 | High7.7 | 1.10.14 |
| Apr 202021 | Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944Medium6.1Apr 20, 2021 | Medium6.1 | 1.10.15rc1+1 more |
| Apr 72021 | Improper Access Control in Apache AirflowHigh6.5Apr 7, 2021 | High6.5 | 2.0.1rc1 |