p PatchFirst

CVE-2021-38540

CVE-2021-38540 · Apache Airflow: Variable Import endpoint missed authentication check

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

CVSS 9.8 · Critical · EPSS 80.9% · Public exploit · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache airflow

    Versions
    • ≥ Apache Airflow, < 2.1.3: Affected (custom)

    Update to 2.1.3

  • apache-airflow PyPI

    Versions
    • 2.0.0
    • 2.0.1
    • 2.0.1rc1
    • 2.0.1rc2
    • 2.0.2
    • 2.0.2rc1
    • 2.1.0
    • 2.1.0rc1
    • 2.1.0rc2
    • 2.1.1
    • 2.1.1rc1
    • 2.1.2
    • 2.1.2rc1
    • 2.1.3rc1
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.1.3

    Update to 2.1.3

Original sources

Check your server →