Homepage
About Snyk

apache-airflow@2.10.0b1 vulnerabilities

Programmatically author, schedule and monitor data pipelines

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the apache-airflow package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insertion of Sensitive Information into Log File

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of configuration variables belonging to other DAG author users. If these variables contain sensitive values, which is a fact out of the attacking user's control, they will be exposed.

How to fix Insertion of Sensitive Information into Log File?

Upgrade apache-airflow to version 2.10.3rc1 or higher.

[,2.10.3rc1)
  • M
Uninitialized Memory Exposure

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Uninitialized Memory Exposure which allows authenticated users with audit log access to see sensitive unencrypted stored values set via the airflow CLI.

Note: Users who are using the CLI to set secret variables are advised to manually delete entries with those variables from the log table.

How to fix Uninitialized Memory Exposure?

Upgrade apache-airflow to version 2.10.3 or higher.

[,2.10.3)
  • H
Execution with Unnecessary Privileges

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Execution with Unnecessary Privileges due to the ability of DAG authors to add local settings to the DAG folder which then gets executed by the scheduler. An attacker can escalate privileges and execute arbitrary code by manipulating the DAG configuration files. This vulnerability is can be exploited by an attacker with DAG author permissions.

How to fix Execution with Unnecessary Privileges?

Upgrade apache-airflow to version 2.10.1 or higher.

[,2.10.1)
  • H
Improper Encoding or Escaping of Output

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the example_inlet_event_extra.py DAG configuration. An attacker with DAG trigger permissions can execute arbitrary commands by exploiting this vulnerability.

How to fix Improper Encoding or Escaping of Output?

Upgrade apache-airflow to version 2.10.1 or higher.

[,2.10.1)
  • M
Cross-site Scripting (XSS)

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the provider documentation link due to improper user input sanitization in the get_doc_url_for_provider function. By enticing a user to click on a maliciously crafted provider link, an attacker can execute scripts in the context of the user's browser session.

How to fix Cross-site Scripting (XSS)?

Upgrade apache-airflow to version 2.10.0 or higher.

[,2.10.0)
Go back to all versions of this package