CVE-2024-45034

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/41672	Issue Tracking
https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/09/06/3	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-07 08:15

Updated : 2025-06-03 21:12

NVD link : CVE-2024-45034

Mitre link : CVE-2024-45034

CVE.ORG link : CVE-2024-45034

JSON object : View

Products Affected

apache

airflow

CWE

CWE-250

Execution with Unnecessary Privileges

NVD-CWE-Other

{"id": "CVE-2024-45034", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-09-07T08:15:11.123", "references": [{"url": "https://github.com/apache/airflow/pull/41672", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx", "tags": ["Mailing List", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2024/09/06/3", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-250"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Apache Airflow versions before 2.10.1 have a vulnerability that allows\u00a0DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. \nUsers are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability."}, {"lang": "es", "value": "Las versiones de Apache Airflow anteriores a la 2.10.1 tienen una vulnerabilidad que permite a los autores de DAG agregar configuraciones locales a la carpeta DAG y hacer que el programador las ejecute, cuando se supone que el programador no debe ejecutar el c\u00f3digo enviado por el autor de DAG. Se recomienda a los usuarios que actualicen a la versi\u00f3n 2.10.1 o posterior, que ha solucionado la vulnerabilidad."}], "lastModified": "2025-06-03T21:12:55.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77CA0BF2-1FC3-41C5-9877-DC8F97EB9379", "versionEndExcluding": "2.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}