High severity · published Sep 7, 2024
CVE-2024-45034
Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
8.8
CVSS
1.7%
EPSS
No
On KEV
Description
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author.
Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Airflow · Apache Software Foundation
before 2.10.1 · source: vendor
AI
Airflow · Apache
before 2.10.1 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45034
Issue Tracking
https://github.com/apache/airflow/pull/41672
Mailing List
https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx
Mailing List
http://www.openwall.com/lists/oss-security/2024/09/06/3
More from Apache Airflow
8.8
CVE-2020-11978
Apache Airflow Command Injection
9.8
CVE-2026-33264
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
9.8
CVE-2017-17836
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow
9.1
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
9.1
CVE-2026-42252
Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern