CVE-2021-45230

Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver

published January 20, 2022

CVSS
—
EPSS
2%
Percentile
77.1
In the wild
Unconfirmed
What it is

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01709 · 77.1th percentile
Published
2022-01-20T10:25Z
EPSS history
Timeline
  • 20 JAN 10:25Z
    Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver
    cvelistv5