HIGH🇵🇱 Wersja polska

CVE-2024-39877

CVSS 8.8v3.1pub. 2024-07-17upd. 2024-11-21

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Airflow

    APP
    Apache
    2.4.0 – 2.9.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2020-13927CRITICAL9.8⚠ KEVPL ✓same product

Apache Airflow — brak uwierzytelnienia w Experimental API umożliwia RCE

CVE-2026-33264CRITICAL9.8PL ✓same product

Apache Airflow: RCE przez niebezpieczną deserializację DAG (CWE-502)

CVE-2026-42252CRITICAL9.1PL ✓same product

Apache Airflow: command injection przez niebezpieczny wzorzec w dokumentacji BashOperator

CVE-2025-57735CRITICAL9.1PL ✓same product

Apache Airflow: brak unieważnienia tokenu JWT po wylogowaniu

CVE-2024-42447CRITICAL9.8PL ✓same product

Apache Airflow Providers FAB — nieprawidłowe wygasanie sesji (CWE-613)