AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowPYSEC-2019-216

A malicious admin user

Apache Airflow

CVE-2019-12417 · Published Oct 30, 2019 · updated Jul 6, 2026

Medium4.8
Fix: upgrade to 1.10.6rc1 or later
Source advisory

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
< 1.10.6rc11.10.6rc1

Changes since it was listed

SeveritySep 24Severity: Unrated to Medium
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity from
NVD
Also known as
CVE-2019-12417, GHSA-q3p4-gw7r-wqjc, PYSEC-2026-617

More Apache Airflow advisories

All Apache Airflow
High 8.8Jul 27, 2020Remote code execution (RCE) in Apache AirflowCVE-2020-11978fixed in 1.10.11rc1Medium 5.4Jul 27, 2020Multiple stored XSS in RBAC Admin screens in Apache AirflowCVE-2020-11983fixed in 1.10.11Medium 4.8May 6, 2020XSS in Apache AirflowCVE-2019-12398fixed in 1.10.5High 8.8Apr 18, 2019Apache Airflow vulnerable to CSRF AttacksCVE-2019-0229fixed in 1.10.3Medium 4.8Apr 12, 2019Apache Airflow vulnerable to Stored XSSCVE-2019-0216fixed in 1.10.3Medium 5.5Mar 6, 2019Apache Airflow vulnerable to Stored XSSCVE-2018-20244fixed in 1.10.2