CVE-2024-26280 json
Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)
published 2024-03-01 2 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2024-26280 , EUVD-2024-0006 , GHSA-6xwf-xvf3-v459 , PYSEC-2024-42
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.
Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
Patch / fix
- pypi apache-airflow 2.8.2
- bitnami airflow 2.8.2
- Apache Software Foundation Apache Airflow 2.8.2
- github.com/apache/airflow@1a96407 commit
- github.com/apache/airflow@7f10998 commit
- github.com/apache/airflow@8324c87 commit
- github.com/apache/airflow@8463ee4 commit
- github.com/apache/airflow@f2ea8a3 commit
- github.com/apache/airflow@f4b9cc7 commit
- github.com/apache/airflow#37501 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.8.2 |
2.8.2 |
| bitnami | airflow | <2.8.2 |
2.8.2 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-276 Incorrect Default Permissions
References
-
github.com
/apache/airflow/pull/37501
patch, web, issue-tracking
-
github.com
/apache/airflow/commit/1a96407cd2d76616c1137de288f092d4f3b097fa
web
-
github.com
/apache/airflow/commit/7f10998c17ab9d725bc8671deb4c12d672bfba99
web
-
github.com
/apache/airflow/commit/8324c87e05741e5a673c43b315619a3788bacc2e
web
-
github.com
/apache/airflow/commit/8463ee4f25114a6c5fb2408d6026afe94bdf106d
web
-
github.com
/apache/airflow/commit/f2ea8a3e1753012bfe0d529c9c8be66cf55ca28f
web
-
github.com
/apache/airflow/commit/f4b9cc74976b7df1acbc3c63471b5751b3e2c40c
web
-
lists.apache.org
/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2024/03/01/1
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-26280
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-42.yaml
web
-
github.com
/advisories/GHSA-6xwf-xvf3-v459
advisory
Sources
- CVE List CVE-2024-26280
- GitHub Advisory GHSA-6xwf-xvf3-v459
- NVD CVE-2024-26280
- OSV BIT-airflow-2024-26280
- OSV PYSEC-2024-42
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.