CVE-2024-45034 json
Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
published 2024-09-07 2 y ago modified 2026-09-10 1 mo ago also BIT-airflow-2024-45034 , EUVD-2024-0013 , GHSA-92xg-gmrq-5c3w , PYSEC-2024-212
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
Patch / fix
- pypi apache-airflow 2.10.1
- bitnami airflow 2.10.1
- Apache Software Foundation Apache Airflow 2.10.1
- apache airflow 2.10.1
- github.com/apache/airflow@03e01e7 commit
- github.com/apache/airflow#41672 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.69% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.10.1 |
2.10.1 |
| bitnami | airflow | <2.10.1 |
2.10.1 |
Affected products
- Apache Software Foundation Apache Airflow
- apache airflow
Classification
- Weakness
-
- CWE-250 Execution with Unnecessary Privileges
References
-
github.com
/apache/airflow/pull/41672
patch, web, issue-tracking, report
-
github.com
/apache/airflow/commit/03e01e76d2203d37aa645096df195b4328665f6d
web
-
lists.apache.org
/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2024/09/06/3
web, mailing-list, discussion
-
nvd.nist.gov
/vuln/detail/CVE-2024-45034
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-212.yaml
web
-
github.com
/advisories/GHSA-92xg-gmrq-5c3w
advisory
Sources
- CVE List CVE-2024-45034
- GitHub Advisory GHSA-92xg-gmrq-5c3w
- NVD CVE-2024-45034
- OSV BIT-airflow-2024-45034
- OSV PYSEC-2024-212
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.