Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table
High8.4CVE-2024-56373 · Published Feb 24, 2026 · updated Sep 10, 2026
DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.11.1 | 2.11.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- BIT-airflow-2024-56373, CVE-2024-56373, PYSEC-2026-2355
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 17 | Apache Airflow: DAG authorization bypass Medium4.3Mar 17 | Medium4.3 | 3.1.8 |
| Mar 17 | Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataHigh7.5Mar 17 | High7.5 | 3.1.8 |
| Feb 24 | Apache Airflow exposes sensitive information in its log filesMedium6.5Feb 24 | Medium6.5 | 2.11.1 |
| Feb 21 | Apache Airflow error reporting may expose full kwargsMedium6.5Feb 21 | Medium6.5 | 2.11.1+1 more |
| Feb 9 | Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated UsersMedium6.5Feb 9 | Medium6.5 | 3.1.7 |
| Feb 9 | Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log AccessMedium6.5Feb 9 | Medium6.5 | 3.1.7 |