Apache Airflow: Variable Import endpoint missed authentication check
Vulnerability Description
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-38540
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Apache Airflow would like to thank Nathan Jones, National Australia Bank’s Offensive Security Team
References
More from Apache Software Foundation
View All →Affected Vendor
Apache Software Foundation
View all reports →