CVE-2024-39877CWE-94

Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

High · published July 17, 2024

CVSS v3.1
8.8
EPSS
2%
Percentile
77.4
In the wild
Unconfirmed
What it is

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01726 · 77.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-07-17T07:54Z
EPSS history
Timeline
  • 17 JUL 07:54Z
    Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler
    cvelistv5