Apache Airflow
At a glance
- Source
- NVD
- EPSS
- EPSS 99.78 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Analyzed
Description
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
Weaknesses (CWE)
- CWE-306 — Missing Authentication for Critical Functionality
- CWE-1188 — Initialization of a Resource with an Insecure Default
- CWE-1056 — Invokable Control Element with Variadic Parameters
References
- https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
- http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13927
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-hhx9-p69v-cx2j — Authentication bypass in Apache Airflow
- PYSEC-2020-18 — The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who mis
European references
- ENISA EUVD · EUVD-2020-0037
- GCVE · GCVE-0-2020-13927
CERT-FR advisories
- CERTFR-2022-AVI-525 — Multiples vulnérabilités dans les produits Fortinet · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*< 1.10.11
Affected products
| Product | Versions |
|---|---|
| Apache Airflow | affected Apache Airflow <1.10.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |