QwikSec

Security Database

CVE

CWE

Training

CVE-2021-38540

Published: Sep 9, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	affected `Apache Airflow - < 2.1.3`

Weaknesses (CWE)

References

https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E

x_refsource_MISC

[announce] 20210909 CVE-2021-38540: Apache Airflow: Variable Import endpoint missed authentication check

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.