Login Request a demo
Medium severity · published Feb 29, 2024
CVE-2024-27906
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through…
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Airflow · Apache
before 2.8.2 · source: NVD
Affected product
AI
Airflow
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-27906
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-27906
Broken Link
https://github.com/apache/airflow/pull/37290
Issue Tracking
https://github.com/apache/airflow/pull/37468
Mailing List
https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5
Mailing List
http://www.openwall.com/lists/oss-security/2024/02/29/1
More from Airflow
9.8
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
8.8
CVE-2020-11978
Apache Airflow Command Injection
9.8
CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
9.8
CVE-2023-25754
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0
9.8
CVE-2023-22884
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache…