CVE-2024-45034CWE-250

Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes

High · published September 7, 2024

CVSS v3.1
8.8
EPSS
2%
Percentile
76.9
In the wild
Unconfirmed
What it is

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author.

Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01688 · 76.9th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2024-09-07T07:45Z
EPSS history
Timeline
  • 07 SEP 07:45Z
    Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
    cvelistv5