GitHub Advisoryadvisory · PyPI

GHSA-fh37-cx83-q542 Improper Authentication in Apache Airflow

MEDIUM Published 2021-06-18 Modified 2024-09-12 Official page ↗
Aliases
CVE-2021-26697
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-269, CWE-287, CWE-306
Reviewed
2021-05-07

Affected packages

• PyPI apache-airflow: >= 2.0.0, < 2.0.1rc1 → fixed in 2.0.1rc1

Description

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue only affects Apache Airflow 2.0.0.

Related

Alias · CVE (1)

  • CVE-2021-26697 The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. vulnerability

Weakness · CWE (3)

  • CWE-269 Improper Privilege Management weakness
  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References