Vulnerability · Published Sep 9, 2021 · Assigned by apache

CVE-2021-38540Apache Airflow: Variable Import endpoint missed authentication check

Critical 9.8

In plain English

A critical-severity privilege mismanagement in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 80.9% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)80.9%top 0.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	apache-airflow	2.1.3	GHSA-h88f-r7cw-8fv3
PyPI	apache-airflow	2.1.3	PYSEC-2021-326

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	Apache Airflow – before 2.1.3

Weakness: CWE-269

References

https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E x_refsource_MISC
[announce] 20210909 CVE-2021-38540: Apache Airflow: Variable Import endpoint missed authentication check mailing-list, x_refsource_MLIST