Summary
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected
Risk profile
6.5 · M E D I U M
CVSS assessment
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Attack vector
- N E T W O R K
- Complexity
- L O W
- Privileges
- N O N E
- User interaction
- R E Q U I R E D
- Scope
- U N C H A N G E D
- Confidentiality
- N O N E
- Integrity
- H I G H
- Availability
- N O N E
Weaknesses
-
Cross-Site Request Forgery (CSRF)
CWE-352
Configurations
1
configuration
Affected products
Vulnerable match
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
From 2.7.0 inclusive
Through 2.7.3
inclusive
Further reading
3
sources